Extracted

• • Target
    Quote-034600_500 KB.exe
  • Size 1.1MB
  • SHA256 99bee9c7498d8bbf660140795ad31220000a408d8234f58bed07939779ce0ed4
  • MD5 50f80b086aac1820defd105200518c2f
  • SHA1 b66cd7c24d5867bc26ad615d33c0123fdc0c634a
  • SHA512 fdf7f4c590ecbd09be60bc29c2feec5b5bd85c74da01641f39b5986f02a32f83199c3b94226dcaf5f68ed27edd12bd5356dcd6dcfcac310d0b249fc36139c025
  • SSDEEP 24576:xb2c6hIECGQ+H/JTL6CfpVobmRi/M9RTQ:xbPQiM/6CxqbmRh
  • TLSH
    T1683501251D463B48CA7E0FB8C122145873F0D89783A6D72A2FFD51F59EA3B84CC6B952
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2