Extracted

• • Target

    doc10010679052382012143717.exe

  • Size

    1.0MB

  • MD5

    1df06ea86eaac59f70bfb0644f3ad683

  • SHA1

    91e7dea1ab7bf436fc4837df885f167c1dc91d21

  • SHA256

    34f94d5066b7b34db54d13762f1f3b11ac1b4cdfb971cc822bc3c4d9a7394994

  • SHA512

    0f2cf855ec05185d4fb046f4552d742a14dad9fdf78e58daa4fe77f96b8afbe83f5c97cf2d064bfbcd2ce071a7499226a39dd969edfdeecc4a2129c476b71cd4

  • SSDEEP

    24576:/TbBv5rULmVeLmvdWULotH9NwCLmtmH6opxUPYhLKX5yaUr:JBVVgeoULGHjVStmHXxUPYc2

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2