Extracted

• • Target
    Urgent Price request P.O 1672891FTN.exe
  • Size 396KB
  • SHA256 69b1dc30ce52a1829b3fcb0071acb578ca72a4bc88efc3d6cee56241f254b541
  • MD5 af3afdb900624af15bd0984c7c6e236f
  • SHA1 ecec1c4b32f1c4b7c36a9e1288ca6fc2e0c37e65
  • SHA512 68665f0412155041c0a1205ed9be133fb1eaf5b15580ffe2e54d24fcd285b2a6dd4cd64cdfd9ef2f4002c9440cac93ef94e0de64f0094775fbdeaa3edd0f3983
  • SSDEEP 6144:/Ya6q0fMteJiHLKzBBF+JmsGhO5nuJLudiBte7SSjxzBJd2KowUylh3eo0sgVAct:/YMztbH+BBFsms8I+rngJUyP0sgh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2