Extracted

• • Target
    d61ea438a50599b93b855d160256f994.exe
  • Size 899KB
  • SHA256 e82d940033891932405dfdeedbd283a3be9dcea92d0a4d3cda675abc3345dfc4
  • MD5 d61ea438a50599b93b855d160256f994
  • SHA1 4b72f7a667de8c7c287952e44a9b7d0227c05d81
  • SHA512 31d00c41fe66e35e3f2e27152ea0c9a61053a8dfc632dcaedb6396c0be273bdabc9bc3dd8df854cdd59bb6affda93ba946a4a2fcff5ce1f74ffa07d084a5894f
  • SSDEEP 24576:NA1n4SzZGe7IImUf6IAe9M0iUCBmeMWhsSfPVCtcu:NAvUInAmVUsSfP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2