Edit tour

Windows Analysis Report
payment copy.exe

Overview

General Information

Sample Name:	payment copy.exe
Analysis ID:	756033
MD5:	52fcd3f3cb7f0eaacc6cc393ba9313da
SHA1:	5a7304f89ce6525e0449ffdf0022f5114d181680
SHA256:	eeabb0a04ea59624d05185afbbf4a1c8e5db554c0c325871c4c0ac5de34c5547
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Initial sample is a PE file and has a suspicious name

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

payment copy.exe (PID: 6064 cmdline: C:\Users\user\Desktop\payment copy.exe MD5: 52FCD3F3CB7F0EAACC6CC393BA9313DA)

payment copy.exe (PID: 1848 cmdline: C:\Users\user\Desktop\payment copy.exe MD5: 52FCD3F3CB7F0EAACC6CC393BA9313DA)

WdFVsOe.exe (PID: 5864 cmdline: "C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe" MD5: 52FCD3F3CB7F0EAACC6CC393BA9313DA)

WdFVsOe.exe (PID: 5304 cmdline: C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe MD5: 52FCD3F3CB7F0EAACC6CC393BA9313DA)

WdFVsOe.exe (PID: 4640 cmdline: "C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe" MD5: 52FCD3F3CB7F0EAACC6CC393BA9313DA)

WdFVsOe.exe (PID: 612 cmdline: C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe MD5: 52FCD3F3CB7F0EAACC6CC393BA9313DA)

WdFVsOe.exe (PID: 2728 cmdline: C:\Users\user\AppData\Roaming\WdFVsOe\WdFVsOe.exe MD5: 52FCD3F3CB7F0EAACC6CC393BA9313DA)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "host39.registrar-servers.com", "Username": "Emenike@potashin.us", "Password": "})cZs aj5Xr;   C"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.310942786.000000000325E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000C.00000002.521910892.000000000323C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.521910892.000000000323C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.258978020.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000000.258978020.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000001.00000000.258978020.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31cb6:$a13: get_DnsResolver 0x303c3:$a20: get_LastAccessed 0x326e4:$a27: set_InternalServerPort 0x32a19:$a30: set_GuidMasterKey 0x304d5:$a33: get_Clipboard 0x304e3:$a34: get_Keyboard 0x318b0:$a35: get_ShiftKeyDown 0x318c1:$a36: get_AltKeyDown 0x304f0:$a37: get_Password 0x3100b:$a38: get_PasswordHash 0x32118:$a39: get_DefaultCredentials
00000000.00000002.261250021.00000000033C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.262257256.00000000036CE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000B.00000002.307766391.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000000.00000002.263520436.000000000462B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.263520436.000000000462B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.263520436.000000000462B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x150ff6:$a13: get_DnsResolver 0x187616:$a13: get_DnsResolver 0x1bda36:$a13: get_DnsResolver 0x14f703:$a20: get_LastAccessed 0x185d23:$a20: get_LastAccessed 0x1bc143:$a20: get_LastAccessed 0x151a24:$a27: set_InternalServerPort 0x188044:$a27: set_InternalServerPort 0x1be464:$a27: set_InternalServerPort 0x151d59:$a30: set_GuidMasterKey 0x188379:$a30: set_GuidMasterKey 0x1be799:$a30: set_GuidMasterKey 0x14f815:$a33: get_Clipboard 0x185e35:$a33: get_Clipboard 0x1bc255:$a33: get_Clipboard 0x14f823:$a34: get_Keyboard 0x185e43:$a34: get_Keyboard 0x1bc263:$a34: get_Keyboard 0x150bf0:$a35: get_ShiftKeyDown 0x187210:$a35: get_ShiftKeyDown 0x1bd630:$a35: get_ShiftKeyDown
0000000F.00000002.520858621.0000000003361000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.520858621.0000000003361000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.522170606.0000000003291000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.522170606.0000000003291000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: payment copy.exe PID: 6064	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: payment copy.exe PID: 6064	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: payment copy.exe PID: 6064	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xfe9ae:$a13: get_DnsResolver 0xfd999:$a20: get_LastAccessed 0xff050:$a27: set_InternalServerPort 0xff237:$a30: set_GuidMasterKey 0xfda7f:$a33: get_Clipboard 0xfda8d:$a34: get_Keyboard 0xfe72b:$a35: get_ShiftKeyDown 0xfe73c:$a36: get_AltKeyDown 0xfda9a:$a37: get_Password 0xfe1b1:$a38: get_PasswordHash 0xfec6e:$a39: get_DefaultCredentials
Process Memory Space: payment copy.exe PID: 1848	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: payment copy.exe PID: 1848	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: payment copy.exe PID: 1848	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xb2e8:$a13: get_DnsResolver 0x9c55:$a20: get_LastAccessed 0xbcc5:$a27: set_InternalServerPort 0xbf2c:$a30: set_GuidMasterKey 0x9d50:$a33: get_Clipboard 0x9d5e:$a34: get_Keyboard 0xaf7e:$a35: get_ShiftKeyDown 0xaf8f:$a36: get_AltKeyDown 0x9d6b:$a37: get_Password 0xa7e2:$a38: get_PasswordHash 0xb71e:$a39: get_DefaultCredentials
Process Memory Space: WdFVsOe.exe PID: 5864	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: WdFVsOe.exe PID: 5304	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: WdFVsOe.exe PID: 5304	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: WdFVsOe.exe PID: 2728	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: WdFVsOe.exe PID: 2728	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.payment copy.exe.474a140.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.payment copy.exe.474a140.7.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.payment copy.exe.474a140.7.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c0b:$s10: logins 0x32685:$s11: credential 0x2e8d5:$g1: get_Clipboard 0x2e8e3:$g2: get_Keyboard 0x2e8f0:$g3: get_Password 0x2fca0:$g4: get_CtrlKeyDown 0x2fcb0:$g5: get_ShiftKeyDown 0x2fcc1:$g6: get_AltKeyDown
0.2.payment copy.exe.474a140.7.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x300b6:$a13: get_DnsResolver 0x2e7c3:$a20: get_LastAccessed 0x30ae4:$a27: set_InternalServerPort 0x30e19:$a30: set_GuidMasterKey 0x2e8d5:$a33: get_Clipboard 0x2e8e3:$a34: get_Keyboard 0x2fcb0:$a35: get_ShiftKeyDown 0x2fcc1:$a36: get_AltKeyDown 0x2e8f0:$a37: get_Password 0x2f40b:$a38: get_PasswordHash 0x30518:$a39: get_DefaultCredentials
1.0.payment copy.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.0.payment copy.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.0.payment copy.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x34a0b:$s10: logins 0x34485:$s11: credential 0x306d5:$g1: get_Clipboard 0x306e3:$g2: get_Keyboard 0x306f0:$g3: get_Password 0x31aa0:$g4: get_CtrlKeyDown 0x31ab0:$g5: get_ShiftKeyDown 0x31ac1:$g6: get_AltKeyDown
1.0.payment copy.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31eb6:$a13: get_DnsResolver 0x305c3:$a20: get_LastAccessed 0x328e4:$a27: set_InternalServerPort 0x32c19:$a30: set_GuidMasterKey 0x306d5:$a33: get_Clipboard 0x306e3:$a34: get_Keyboard 0x31ab0:$a35: get_ShiftKeyDown 0x31ac1:$a36: get_AltKeyDown 0x306f0:$a37: get_Password 0x3120b:$a38: get_PasswordHash 0x32318:$a39: get_DefaultCredentials
0.2.payment copy.exe.474a140.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.payment copy.exe.474a140.7.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.payment copy.exe.474a140.7.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x34a0b:$s10: logins 0x6b02b:$s10: logins 0xa144b:$s10: logins 0x34485:$s11: credential 0x6aaa5:$s11: credential 0xa0ec5:$s11: credential 0x306d5:$g1: get_Clipboard 0x66cf5:$g1: get_Clipboard 0x9d115:$g1: get_Clipboard 0x306e3:$g2: get_Keyboard 0x66d03:$g2: get_Keyboard 0x9d123:$g2: get_Keyboard 0x306f0:$g3: get_Password 0x66d10:$g3: get_Password 0x9d130:$g3: get_Password 0x31aa0:$g4: get_CtrlKeyDown 0x680c0:$g4: get_CtrlKeyDown 0x9e4e0:$g4: get_CtrlKeyDown 0x31ab0:$g5: get_ShiftKeyDown 0x680d0:$g5: get_ShiftKeyDown 0x9e4f0:$g5: get_ShiftKeyDown
0.2.payment copy.exe.474a140.7.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31eb6:$a13: get_DnsResolver 0x684d6:$a13: get_DnsResolver 0x9e8f6:$a13: get_DnsResolver 0x305c3:$a20: get_LastAccessed 0x66be3:$a20: get_LastAccessed 0x9d003:$a20: get_LastAccessed 0x328e4:$a27: set_InternalServerPort 0x68f04:$a27: set_InternalServerPort 0x9f324:$a27: set_InternalServerPort 0x32c19:$a30: set_GuidMasterKey 0x69239:$a30: set_GuidMasterKey 0x9f659:$a30: set_GuidMasterKey 0x306d5:$a33: get_Clipboard 0x66cf5:$a33: get_Clipboard 0x9d115:$a33: get_Clipboard 0x306e3:$a34: get_Keyboard 0x66d03:$a34: get_Keyboard 0x9d123:$a34: get_Keyboard 0x31ab0:$a35: get_ShiftKeyDown 0x680d0:$a35: get_ShiftKeyDown 0x9e4f0:$a35: get_ShiftKeyDown
0.2.payment copy.exe.34005e8.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.payment copy.exe.34005e8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xd236:$v1: SbieDll.dll 0xd250:$v2: USER 0xd25c:$v3: SANDBOX 0xd26e:$v4: VIRUS 0xd2be:$v4: VIRUS 0xd27c:$v5: MALWARE 0xd28e:$v6: SCHMIDTI 0xd2a2:$v7: CURRENTUSER
11.2.WdFVsOe.exe.2f9063c.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
11.2.WdFVsOe.exe.2f9063c.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0xd236:$v1: SbieDll.dll 0xd250:$v2: USER 0xd25c:$v3: SANDBOX 0xd26e:$v4: VIRUS 0xd2be:$v4: VIRUS 0xd27c:$v5: MALWARE 0xd28e:$v6: SCHMIDTI 0xd2a2:$v7: CURRENTUSER
0.2.payment copy.exe.46b2520.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.payment copy.exe.46b2520.8.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.payment copy.exe.46b2520.8.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xcc62b:$s10: logins 0x102c4b:$s10: logins 0x13906b:$s10: logins 0xcc0a5:$s11: credential 0x1026c5:$s11: credential 0x138ae5:$s11: credential 0xc82f5:$g1: get_Clipboard 0xfe915:$g1: get_Clipboard 0x134d35:$g1: get_Clipboard 0xc8303:$g2: get_Keyboard 0xfe923:$g2: get_Keyboard 0x134d43:$g2: get_Keyboard 0xc8310:$g3: get_Password 0xfe930:$g3: get_Password 0x134d50:$g3: get_Password 0xc96c0:$g4: get_CtrlKeyDown 0xffce0:$g4: get_CtrlKeyDown 0x136100:$g4: get_CtrlKeyDown 0xc96d0:$g5: get_ShiftKeyDown 0xffcf0:$g5: get_ShiftKeyDown 0x136110:$g5: get_ShiftKeyDown
0.2.payment copy.exe.46b2520.8.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x34e27:$s1: file:/// 0x34d37:$s2: {11111-22222-10009-11112} 0x34db7:$s3: {11111-22222-50001-00000} 0x33f41:$s4: get_Module 0x342bc:$s5: Reverse 0xc88a6:$s5: Reverse 0xfeec6:$s5: Reverse 0x1352e6:$s5: Reverse 0x2f3b2:$s6: BlockCopy 0xca8ec:$s6: BlockCopy 0x100f0c:$s6: BlockCopy 0x13732c:$s6: BlockCopy 0xc8b64:$s7: ReadByte 0xff184:$s7: ReadByte 0x1355a4:$s7: ReadByte 0x34e39:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.payment copy.exe.46b2520.8.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xc9ad6:$a13: get_DnsResolver 0x1000f6:$a13: get_DnsResolver 0x136516:$a13: get_DnsResolver 0xc81e3:$a20: get_LastAccessed 0xfe803:$a20: get_LastAccessed 0x134c23:$a20: get_LastAccessed 0xca504:$a27: set_InternalServerPort 0x100b24:$a27: set_InternalServerPort 0x136f44:$a27: set_InternalServerPort 0xca839:$a30: set_GuidMasterKey 0x100e59:$a30: set_GuidMasterKey 0x137279:$a30: set_GuidMasterKey 0xc82f5:$a33: get_Clipboard 0xfe915:$a33: get_Clipboard 0x134d35:$a33: get_Clipboard 0xc8303:$a34: get_Keyboard 0xfe923:$a34: get_Keyboard 0x134d43:$a34: get_Keyboard 0xc96d0:$a35: get_ShiftKeyDown 0xffcf0:$a35: get_ShiftKeyDown 0x136110:$a35: get_ShiftKeyDown
11.2.WdFVsOe.exe.2f72e6c.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
11.2.WdFVsOe.exe.2f72e6c.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x2aa06:$v1: SbieDll.dll 0x2aa20:$v2: USER 0x2aa2c:$v3: SANDBOX 0x2aa3e:$v4: VIRUS 0x2aa8e:$v4: VIRUS 0x2aa4c:$v5: MALWARE 0x2aa5e:$v6: SCHMIDTI 0x2aa72:$v7: CURRENTUSER
0.2.payment copy.exe.462b3f8.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.payment copy.exe.462b3f8.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.payment copy.exe.462b3f8.6.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x153753:$s10: logins 0x189d73:$s10: logins 0x1c0193:$s10: logins 0x1531cd:$s11: credential 0x1897ed:$s11: credential 0x1bfc0d:$s11: credential 0x14f41d:$g1: get_Clipboard 0x185a3d:$g1: get_Clipboard 0x1bbe5d:$g1: get_Clipboard 0x14f42b:$g2: get_Keyboard 0x185a4b:$g2: get_Keyboard 0x1bbe6b:$g2: get_Keyboard 0x14f438:$g3: get_Password 0x185a58:$g3: get_Password 0x1bbe78:$g3: get_Password 0x1507e8:$g4: get_CtrlKeyDown 0x186e08:$g4: get_CtrlKeyDown 0x1bd228:$g4: get_CtrlKeyDown 0x1507f8:$g5: get_ShiftKeyDown 0x186e18:$g5: get_ShiftKeyDown 0x1bd238:$g5: get_ShiftKeyDown
0.2.payment copy.exe.462b3f8.6.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0xbbf4f:$s1: file:/// 0xbbe5f:$s2: {11111-22222-10009-11112} 0xbbedf:$s3: {11111-22222-50001-00000} 0xbb069:$s4: get_Module 0xbb3e4:$s5: Reverse 0x14f9ce:$s5: Reverse 0x185fee:$s5: Reverse 0x1bc40e:$s5: Reverse 0xb64da:$s6: BlockCopy 0x151a14:$s6: BlockCopy 0x188034:$s6: BlockCopy 0x1be454:$s6: BlockCopy 0x14fc8c:$s7: ReadByte 0x1862ac:$s7: ReadByte 0x1bc6cc:$s7: ReadByte 0xbbf61:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
payment copy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report payment copy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Windows Analysis Report
payment copy.exe