Extracted

• • Target

    1143a49474a9e04635652039747cdde4.exe

  • Size

    720KB

  • MD5

    1143a49474a9e04635652039747cdde4

  • SHA1

    d80ed0fbec15c3bab2ceae8e3f4295e89bed3fef

  • SHA256

    d2bb93bd846b91bdd8e55a84c14bb324761328b8b08d8ebf2493b09277c5bdac

  • SHA512

    4b6a04ae6a1698c56a3762218cabca55cf6bcf35b96fbca7c5bc5289dc8d116b47f639bceed14d621f9169585115576d75014177eb47bb6d0f509e89b2eed38c

  • SSDEEP

    12288:CciUMqOd1wAQMjyOdUvfZbelXWLZ7vdV67QjE08O4W9jSC2mZJbxpDF:BWqbA8TLZe7Y45C2

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2