Extracted

• • Target
    Al Wasl Trading L.L.C Quote 260550878.exe
  • Size 943KB
  • SHA256 77954aceb0ce403be86b14588e57bba75c06e9a0b65d4ddc01b1ca6e55770102
  • MD5 edab838a9c2af487eada7b7934f486e7
  • SHA1 fd555583dc5538b13c0ad67b12462fad8960be79
  • SHA512 36a2538b5911368cd11152fce22acce511ed14899ce83d59ab65253c8e3f151ddd0921ac6c767c27defac0701a01299609c30210f2c10dcc31c8a934aa5ecf6c
  • SSDEEP 24576:ULgP0Fg5YCJE1AdmmGvsPaCZ1UeC+6NU1v4J2/CLA7qBT6cw1RFTg8hg7:6SMTaH8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2