Extracted

• • Target
    SecuriteInfo.com.Gen.Variant.Babar.125059.7342.21493.exe
  • Size 242KB
  • SHA256 b3271cac975a34320b8dd67850d535e5ef96651e3371356cf3ec7cfca34a3caf
  • MD5 c501da741daaf9b168d69702ab31ef72
  • SHA1 16937fc3f7e3f22ba17ad14991af5db5100ce56f
  • SHA512 f629b2ca91fe4899906a12f911deb53220cc4b3d934c64200c8c36d481e4dc5eae1b65696e12125e97a60019cb72bc32470affc78d24b411a699062335c5cf41
  • SSDEEP 6144:LkwTEnOTyRalNKYTTd5m4fVnGUk3zk15diz/G:6OTyRal8GTSwz3ia
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2