Extracted

• • Target

    PO-3-07-23.exe

  • Size

    901KB

  • MD5

    fcbd587b894d3d1508268b67c02d220f

  • SHA1

    432a697f05de00a09d5d237dec6e0aa49cea03f8

  • SHA256

    c0cbab8b9504e2575456d0f902b264123362665031999a3f780c2a5c2f0b9512

  • SHA512

    6d9dfe62c73816754f8caada2c3e980a6900ce100afa0005c2cd9e30ec181920e80abd3dea9bc4956ba725b103efbed3469d3dc5b149bdb86dc2b30af6b83450

  • SSDEEP

    12288:ke3ygxIyjPpBSqGiyol3PQJih+ZKdGUFRP0TVfXVZ67cNNBD9s9Etl0vjC44dBjj:ke3VTpBS3UZEs5sTRbBDsQD

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2