Extracted

• • Target
    recibo de pago anticipado.exe
  • Size 1.2MB
  • SHA256 a2b77c33ea165b0a7b753e41a7b9bc0c626cc323feb031203cf3d52e3f750f9c
  • MD5 a64b88886eb159809acf533b4ffd23df
  • SHA1 5658db16e8b944ce20fb293617e26caed77cb687
  • SHA512 ed904a5f6d7ba0585ee1fccf4b942c885e4c00314485f2d757fb820e62860eab4c4088bd9d6b865dddaeea0fd482113492f2a774b45a006b04f404de5dd14c3d
  • SSDEEP 12288:zkiAJBBfe7MYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72BrgbkNEQCvoGFvxGtY:4toAPCmQui1rBgc+90HEQCvoGF4Y
  • TLSH
    T1ED45CF2D368F495CD5A1DB788F333BD41770C47658F2D35ABF8C5378A62A6E09A8C242
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2