Extracted

• • Target
    SecuriteInfo.com.IL.Trojan.MSILZilla.23263.25992.20476.exe
  • Size 16KB
  • SHA256 a2a3fd4b8c4a6ced54de6a596a9cd01b974ecd40fa7b016da293a1fb267efd0a
  • MD5 c8d3d81956897a5becac1c93ef820412
  • SHA1 bde21cdc55e23946d5070181153d9e00b9581d5b
  • SHA512 7389b5f9737a6eae220cfdb5280777e76faad0e5e2e5ea0a3e5fd00f5c5ad74767c037603d0e5f63e26621357325306626680f4c5b470c1856f3ce4af155388e
  • SSDEEP 96:Gdpv1VPgm/YdONxslVOFz7f1BXCdJSihfSYons6ixZ6ZZkugeH6q26QBqfFQUqzj:G31JeCz71In9/CK6EYRM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2