Extracted

• • Target
    af2a4df6137e85a5f69a4e5478992d32bee91b7208757879e3b98aba9ec88919.exe
  • Size 720KB
  • SHA256 af2a4df6137e85a5f69a4e5478992d32bee91b7208757879e3b98aba9ec88919
  • MD5 c245f014d04a484d2612f4963e05226f
  • SHA1 f90de5146a34a93eddf87f46810a4dba729237b6
  • SHA512 6edb2e13606e335b3f36f77056335427f398ca58dec824ba0c82c37f8b73af8a05915b33d12365dbf80392c7c8a1027ae9584eae7b1589860441fabd1b3bea09
  • SSDEEP 12288:IZid7UZh6q6/TKPzG7nKR5OI6pdieA7d9MWd52P170BNxTpsVwdhmm1TIjWo56NO:IZidcY/TKPzG7oIfieKjMABBNJ2gmmTM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2