Extracted

• • Target

    0b38beeaa74c58cb3a4520dacb146db5.exe

  • Size

    967KB

  • MD5

    0b38beeaa74c58cb3a4520dacb146db5

  • SHA1

    8a89e1cf58904686256e7bd4ef69fd9abfca443d

  • SHA256

    87e59c9688182f1292e492e79d2298f1abaf9d4dc3204f20ba1f1ec39908d5ba

  • SHA512

    a33cadb98a9bc234bbf32937b616ce878d7f490351569c03cec227c82e3717afe6127acbe89cb9b25db4f9ac5460e9058564b045c925b218b1e69925fcfab507

  • SSDEEP

    12288:QRQEemYEsAahN/X4QXHvuNgZQVcQAS+9IMqbBbGbwWlZtxF6rGQVPnvQ7zqhgKZK:Qtsd/Z+/KaowHAv7EfxhZZI2F

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2