Extracted

Extracted

• • Target
    Documenti di spedizione 000293949040405959000.exe
  • Size 584KB
  • SHA256 e6f50a0c2551c1d2593b8963bac95b0a3f4aad6d6b60d2a4e09d0c70dfd37649
  • MD5 5d32495cf3af0094a17aa09f76b7d27c
  • SHA1 3009c98452cd000828b3bf0ba8ad5b72d05c7f7e
  • SHA512 afa9331ef7fdf6b261b1a1164af17ab52fccb3f24ff659bd6242bf01ba210989bf326e4ba0141cdbb994f0759061f87e498a86fad7d77d566aa26dfcad35ebc1
  • SSDEEP 12288:7O7LcE7rjYvGrCLXBozBd6bRMgvChOW1AsQ6nBhhdBrGZ:ZEcu29ozBUVMgvNW1AsQOfRG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2