Extracted

• • Target

    SCANNED COPY.exe

  • Size

    1021KB

  • MD5

    f81005ba703fb34476ce879d75ec5ab8

  • SHA1

    dd61ce1cdd440dd8a09c039f4729ade2970ba875

  • SHA256

    708854bca2cd2ab2e484b373b82e18a23cb0c0bfd89c4fa6f9ec9b6ee406e4bc

  • SHA512

    a1754b9dcb9b0a3339483aa7deda203073bb1c2644c6078e4537a796c605eafa98c86a5a8ed9b6c206ad9d1a54ddf30b6ff8b4a1b09ccbfc2577c47243287e1f

  • SSDEEP

    12288:jCrehz4X2iNXYoJkwhTMuN8XYDjpVa1Sa6qRTYc8CaSO3PcifOAKjgXZQky:jCrCz4X15v8oDyWZh3PBlKjaZ+

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2