Extracted

• • Target

    FedEx Receipt_2314174712.exe

  • Size

    821KB

  • MD5

    8d0a2a254b9cb085a733265d00950789

  • SHA1

    e0ad9b267f52bc134ce9f72e77e507fc9e4f01c4

  • SHA256

    02efa36dd4234ec4d70a085ef835696433943672021e90a20bb1d61bf0871ed8

  • SHA512

    041597c350b2a3f46cc7fde65f12e3c0ab7848bf9b9fca23a512a89f63b5c77d0675a3d8ac96e9b6247dcd21c8e32a9adaa7901d97ddb42a11d7864c12f78c5f

  • SSDEEP

    24576:HeSqG4yPaw6F0s14r5K7R6Zp79Y9OtgOSBVaogRM:IlWs14r5K7y9YwtgOS+ogC

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2