Extracted

• • Target

    GHYJZmLLUrK1rL7.exe

  • Size

    908KB

  • MD5

    21fcab8e0edf4fdf0297025366645193

  • SHA1

    8e33468a95a1310cc7c1e5b3449bfcb12fa0a10a

  • SHA256

    077cead95be622bb2490f027f43449e198f91e189469da4a48adea41d5286e5d

  • SHA512

    0ce4bcf7dc356e47be0cc1f1642fb705d0d5ed0da54d4ee36ce8d4a7ce2da922300cc8262db672324693e2d17a2cc06cae01e0989e2bf30e043404726901edfb

  • SSDEEP

    12288:1ALv2P7Lj/c66AuaClgT70y3awWecpQ26BqPwNK7sb7/sn1gSp4JZn9jq+6cMEFh:SLYLj7Ju/gIyKjyPe7w7En1gSp4Tn9j

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2