Extracted

• • Target

    ETD-04-12-2022.exe

  • Size

    1.0MB

  • MD5

    92ec3ce5c18ac906b8105029e1792e14

  • SHA1

    8d6cbb4ac71da3b45fa308f4943bf5ae20476ab1

  • SHA256

    28deb46904cc62b51f198c1a962a1d0d9f91745de1a242a4711c1fbc956e6322

  • SHA512

    1d52e765032b62636f1855a4ac503f9ca1e3b33552f02bedf803acf41d17ecfc644fa32e48aa706d434088bb1398115356b5488fc07f85428c5dce0dc20d78dd

  • SSDEEP

    24576:plKcQw+mUXVouprIlTS2uQ6cIG8/a9XVch1:JJUXnrIdS2V6cIG8S9uL

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2