Extracted

• • Target

    243424396-041942-sanlccjavap0003-2745.exe

  • Size

    485KB

  • MD5

    570f75822327ab67501bcf60b5a5015d

  • SHA1

    f8247519442122f8b727910ae977a3072b9e706e

  • SHA256

    3e60205f7f9428199cf532ac669704b7c0b4112f35aa8061d6efc941948e9e35

  • SHA512

    e2aa892438630c43d1fb07d5cf1ecc5781d6a8079385d4095eaa83aba9a5234a78111d396b91499b405adde712c4b6fb6be9db9dc7aaa16d6f5dcc64f3cea912

  • SSDEEP

    6144:aasRfC5mAhrNngWKklCnLUP4igs2fr0hQtP9pDpmIblrsXU/4pd6nscwcT4UyO:erAvguoLUNUrfB99sGlrEpsncM

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    cf85183b87314359488b850f9e97a698

  • SHA1

    6b6c790037eec7ebea4d05590359cb4473f19aea

  • SHA256

    3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

  • SHA512

    fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

  • SSDEEP

    96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug

  Score

  3^/10

  discovery
  behavioral3behavioral4