Extracted

• • Target
    A200N0045.exe
  • Size 694KB
  • SHA256 22235f4edec77bf047d6f5f3ea4d7b4abcc5b3468d306cb66b92e49001768fae
  • MD5 69ed2257aef9b1ec1e45b122e3d72cd0
  • SHA1 a3f1780e001886b92dc88a9965e8e7bd60561f48
  • SHA512 83e18f4e61e0ed92314e6b6ac727b7246eab4a4be44a8c6099ce5e7bbb74bccfc5738f8446719f07eccffb1007a98838fe7d0d5fdf04bc7bb540c80f1d3174b3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops startup file

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2