Extracted

• • Target

    INV_9257.EXE

  • Size

    908KB

  • MD5

    822cbbe5cf85df754bf93817407c0fe5

  • SHA1

    8df5f1d947c47e80fa82136a49be3371b0213b3a

  • SHA256

    e83343e553c570230db6b0913a71a19c4d32356a3efccf716c5412595d2b81fc

  • SHA512

    3c1548498c499aca0ed379a2f558fd80220257c0eb993a54b7ef47e9d2944bbd2a9326c0e45ce34abb32c720311ea3765940983063048447d182bc60505fc854

  • SSDEEP

    24576:08tHxIYioObO8udysBe7w7En1gSp4Tn9j:08tHxIYioAO8cysBe7w7EnOSCj

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2