Extracted

• • Target
    PAYMENT COPY.exe
  • Size 973KB
  • SHA256 617e47d126409219359c49e4f9cbabb7bd488055f954a4777030ff5c49541736
  • MD5 747234db7f9fec2067e1933a32ad63c6
  • SHA1 ca4918a0a8436a44d2d9c027be5ceed5f19b1d63
  • SHA512 d1db4b1b727a05f55cd7dc2c1dbe43d9109f7cb2dfb758e772400a7fc97007b2809a3f71c392dce332bedeead0f51567b656ec0ce493d54186b65bac5f8ceac1
  • SSDEEP 12288:NZIJvTegZNi4WYXtciXnppA30Ix1yu4A26QWX8TAJSMpZ2WhuEeEGsMsGsM2zV:oJjFftci5pOx1yuSwJfpZ2Wpt79
  • TLSH
    T16725BE442658DA07C4BA63B4C961F3F433A92E9AE821D3074ED7BEDB7931B40491639F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2