Extracted

Extracted

• • Target
    ORDEN DE COMPRA ABL245496.exe
  • Size 904KB
  • SHA256 2a084e79463e72c0933ec50e0b89aa2cdd5295584b6d6b211da98c5a3b4a8a8c
  • MD5 cdd42dc7fde55600b226f27181d96120
  • SHA1 5e0a84a5208366f86671eef7699c3f22f6dbc07a
  • SHA512 9e1b8ae0e0df14bb229d5defde13e9e92822db50ea264d646f91df9bc3f4f1eb644b6a43a472813f82ad7470aff11c333cc92f24761deab9e858ffa12fd5cff7
  • SSDEEP 24576:s/3l0VmLLduFe6S2rn9RUsc1K7NLoGo0c53:4emEa1ALvM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2