Extracted

• • Target
    beecde4daa66ae172890ad39beaa293b.exe
  • Size 362KB
  • SHA256 1c220e85384289de8d43ef19cbb91ab72dd48d4726d90e58ee4ac5dfba40a996
  • MD5 beecde4daa66ae172890ad39beaa293b
  • SHA1 16111d82d1d32babbdab747b3eb50c2250a24331
  • SHA512 f331ff01af5cdccd24381444291e7244ace908b78514747cd45099aaa284f4c1a452cbf4344697b9f03cb17e0673f2572409159370b08349f0f892c93b76adac
  • SSDEEP 6144:0Ea0MrGexqsVZmsxYqfBGa0qROjUUIVfkRyuh/FiOmDbIHPGBFwKp:mrlrRxYqfkfj6IFiOabIed
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2