Extracted

• • Target
    _1bcef2581d32b1f631a27a54de845474df714af8ed35729333bc0e0ebd02607d.exe
  • Size 905KB
  • SHA256 1bcef2581d32b1f631a27a54de845474df714af8ed35729333bc0e0ebd02607d
  • MD5 040d73b66b2daef1ab6d3582dcef551b
  • SHA1 ce60a8cf096cf96983d0e14003ff0249d7c8ab5f
  • SHA512 6166505566516f11ca072439c02075cee4331253b01e1d5817ef434d183fa844b44bb7f22cf064e16133b38e52fa15bf8de68442bd95125d4d088b2676cdcfb9
  • SSDEEP 24576:aqFWfwppQ4uZoQGE+JiCkHEQCvoGFfY/:AIppQ/ZZYkHOvvFf
  • TLSH
    T1CB15DFB18F631F20C73C0778C82BA08D67F49927E356DA8F6EF841E45A52764E6136D2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2