Extracted

• • Target
    factura.exe
  • Size 900KB
  • SHA256 2d97b013295699f2cbd5d826a33c35efd5067a96419b5b11e38898418a3b031e
  • MD5 0dcb4ba05de2d05f1b981f2543c889ab
  • SHA1 6cecd1091b4a65ef1cf0abbab28bd49f0ec57ffe
  • SHA512 22d8b64108a608b14d535d6434a8620545db6b991783ab6fae2905c0d8fbac64516f4a5f83991a47a19f913ab2fb37546195a632c0418853a4da9e2d3c4a1b8a
  • SSDEEP 24576:op/dqLDB9cxOMu3beAUPK+jA/cYFuHEQCvoGFtYM:op/dqd9cxOMu3beAUPK+jA/cYFuHOvv7
  • TLSH
    T110159D96EE01A651D4A927FEC1E0445DE7F4EE06A348F30A7EE877FA56B3181C903E05
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2