Extracted

• • Target
    FAXMESSAGE.exe
  • Size 848KB
  • SHA256 26ef0814a002bedcc9770f2b3c5c79787fd036c7bf9f48691a26fa2bfbd9043e
  • MD5 a108331316cdaeafcd71daa1de0dee28
  • SHA1 9487349d9a526fb370f79cfe03049db8cd31b0bd
  • SHA512 20e908a85cf3a196173bb9fa28d7b16bfebdcf2cdd2b871516c466a61e052c3037e52a26e73099336378ac9e6b240b6c5b90ba0d4273c59506df5756ff49f31c
  • SSDEEP 24576:gA3TWNGIJfua6jldEFe6rxN5IC54TWM8:/5Va6+Ttgi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2