Extracted

• • Target
    Invoice 20202009.exe
  • Size 535KB
  • SHA256 2df3e51954ea1df7ed33355df01412a600f8e23a09b0f0c9c99af13d7f90cebc
  • MD5 c1316d55e0d0312821f35b03eb1ead46
  • SHA1 497d63284a8ca98b777409a88a527f8a0a0ccefa
  • SHA512 0a56efffcca1471aefe4290edd62b5d3e4a0d5fb686e600d43ec9e43c3ff57d8127d8519593922d5e94e2f78d5f35a8398898d121d770d9ee27c6f06a6c2d90c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agilenetkeyloggerstealerspywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2