Extracted

Extracted

• • Target
    chitanta de plata 002093940409505050960000.exe
  • Size 329KB
  • SHA256 5a4e470b3209d805f2c4f0707795907a5e5d2964d1ec35b9b42eb8e6d5dc9f82
  • MD5 dfc4049de3311d05b6027601575b7b11
  • SHA1 67cc8c411bed9e48ce37f5f3eb18da0e45563439
  • SHA512 8be56d3f8816c32d0c51f2f0b5f5850a6f9dd3ae43c1fe41ac4a95cc107ceff9ac278509ebf242e9f33b33bd3a0df399645cf348a5f2587b5e1dcc5a4b640a3a
  • SSDEEP 3072:MRO6ZpYlgVM+LmAgIhfc2Zyn2nKGqbxXMORAjgxisAl9YiJGshVyu40+To+CiJWk:mA+VOAU2ZyCKLbxXrHkGyOHkH7VYpM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2