Extracted

• • Target

    commercial invoice-AD1-2001028L.exe

  • Size

    6KB

  • MD5

    8d936312a59afa52e18a4d665755690d

  • SHA1

    aa34c27cdf073eb5c54e371714d3d68a626bbbd8

  • SHA256

    ee511bade3822feb689576b65cb3e490e9459c11c5b6583b36920f742c1bd99d

  • SHA512

    b36924fe5af405e6447fbf01d6d9c75cfe9dc335e36b64ea8982e59a1d9ac48dde4855f5c84cdcc21fb4d4dcbbfca1e485bbd32f04b10d67c1dc577aab9abd65

  • SSDEEP

    96:awqkGAzKfGe7DVys+BWfik85EOd/vSGQeMFnU:N4DUDEPYEOdES

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2