Extracted

• • Target
    ea287c92bdc2ed4c190ebc1be7bc18b2da94ee17a6fc6e3df9d4dc06a01c0fa3.exe
  • Size 1.0MB
  • SHA256 ea287c92bdc2ed4c190ebc1be7bc18b2da94ee17a6fc6e3df9d4dc06a01c0fa3
  • MD5 95fc1db123ea6bac59036f915102b1c5
  • SHA1 07920652156ec3a236e8433d76d4faa607f8b497
  • SHA512 c466d83c413fb5aed37d0927b9626c87502707fae6dc9e3a90c14755236751f49709c3002db0908808f7b9b2fed1763ab51c4fc31bfa5192e08eca0bd07d3917
  • SSDEEP 24576:ke7w7En1gSp4TTyAMUI0LkjBqv5ti3s9jAk:ke7w7EnOSCgkkFqv+3s
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2