Extracted

• • Target
    ORDER_20.EXE
  • Size 945KB
  • SHA256 673e3bfb2595b5d686e947a8a67b89e57271037c92a076ef8221b4fea0d387e5
  • MD5 486b168c4f9d12504e038e4b847a9906
  • SHA1 214febf912dc507a0a07c9cba787507029f75b13
  • SHA512 739dc0194a364fb9d1cebc5cda92febf7ef8b1d9a0a92cec9d040d8e936636ff9603bda2c9849d3c8f9c16d8e52bb2275bae01a89ffe97a6b03100545a8c85bc
  • SSDEEP 24576:nPDJnPjl3NiRM7PA3z3elCurb3ewHdqoXpDDL:nPDJbVNfLprb/1L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2