Extracted

• • Target
    P.O.exe
  • Size 1022KB
  • SHA256 9714f79bb2296d3108cbf1c692bef6578e65bff5d17a80df942bbec516b45c84
  • MD5 d9f499d24cf235757840dea598462c7a
  • SHA1 4009082edb6905c656932c331ac6131222a28a9a
  • SHA512 bfbc7e5f4d5b33195707597a7e3707d1df0e65265b4e68aaa6b5947edba30ee28c333f31500f00c9f51725daf88174e7525ba1667cfff08a4d3dcd4f900b03d8
  • SSDEEP 24576:POF8HKLZ4e2sAh8cYHJPBiSXy9IEV/bOxX:W2HKtH2t2cYpPBivfO
  • TLSH
    T16B25F1365D822E44C63D1FB8C023555877F0D817A2ABE74A2FFD10F66BA2B81CD2B855
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2