Extracted

• • Target
    Order#072302.exe
  • Size 293KB
  • SHA256 45ed129be4c3b3138d02e8907f7e28702036ca8de932f39ed1bf14bb917d1b63
  • MD5 d885d232d75aa7835e7d5776962bc67c
  • SHA1 5539f8fb61a3e74dfd400dfcdf15dca8d655de10
  • SHA512 8ee36ef10c6f8bdf58313bf342a5ad3fe62c582920c4eee0949bb5aac0d394715d5e524b88832edb1ed17c5b13471a19bdda89912ba9e1a798ad7f572cc2d873
  • SSDEEP 6144:DYa6b8YqLH0X5dwZH4+4WPL73HeiKWWt6mh5Wu:DY5nHgZH4ZW/Womhj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2