Extracted

• • Target

    ORDER (6256 OS)#391 PI.exe

  • Size

    853KB

  • MD5

    19081ef2a08f678a3203b29124043c41

  • SHA1

    e86acea06a600f170402a0c1020c25ac2550ffa0

  • SHA256

    2f356283c209400c6385a24450f266b59477e035e9389c8d1af4843cd1ad2374

  • SHA512

    aad284ae800f26f6d27a12ec66cd42c781861de7fbd907b8c5b3938dc8fa343286b35e21a56c3680cc92e36d1857fb8f1fd53796f3a82be182245493855ffa3f

  • SSDEEP

    24576:F2ibxF1RKDbH8emeHmXlO3Qe5/uwg5+RAj:/xFqXHXmeOlO3QW/2e

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2