Extracted

• • Target

    5fbe6212aa1f6621aa540b2fb2ce00a4.exe

  • Size

    1.1MB

  • MD5

    5fbe6212aa1f6621aa540b2fb2ce00a4

  • SHA1

    bef2c5a8800f6106b11472b065481126c91da0c3

  • SHA256

    9a47130a1c6261043e0388cb920260c0514377ac5ad2d56aa7c579c06946f689

  • SHA512

    4cb89c2f1e7636b1ebc11a5268f6c4c338584c006705df7871630f318a8808bd6a66b3cda40f7d899e9fea20e6cf0678a12455e4c8bb70c435ae9d953635eac0

  • SSDEEP

    24576:521Xjqm8pmgSvZUxE9dv0fUwhKmx66pFsf:52Fjb8Xfxk0xhKr

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2