Extracted

• • Target

    FORMAL_B.EXE

  • Size

    667KB

  • MD5

    8df8ab7204e57429999d3d8d05c98cb2

  • SHA1

    07269ca1f7ee57c0023562af092bfc4ac058308f

  • SHA256

    ffafcbbf3656e0ace64d99d6e93abd741386bf0a4542839a5c8b9db8414b7a1e

  • SHA512

    a233371be591a6d306499de1b31b57ceefbb2d515966e8d408f6279317579d2435c6175c32c2f1e7085d9410de7804d5a0981c88d3d956e7be8950402e2b3ba0

  • SSDEEP

    12288:3ex1HsAa1AR5M6jCDknVBzcQ5/boNv/cLUt8IHFppV288NTYY7:Ox3a1sNGDGV3FAAIH+88NTYY7

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2