Extracted

• • Target
    4519de9e3f5efd9400ddfdea287b5daf.exe
  • Size 795KB
  • SHA256 6c8b93bdd0153dfe2c4ff9e4c758ec44f3e01fbb77cb54b51e7ed07efa734a44
  • MD5 4519de9e3f5efd9400ddfdea287b5daf
  • SHA1 3caede68f0bd9e89b241c73064dd75a29095b422
  • SHA512 656a759aee1b28d470bf32368e4d0372786515a1477730e3e790e642242ec4d801180361ff79af85d7d99164e6686823ebb85ee36ccbd612065d5a14d389004c
  • SSDEEP 12288:cA5xB0OpJhZDrxDzJOzrsj8O8wluaUVnBNrRs94SQnzd9Gwg2ZvRDM:cA5rZDDN5OkIpwldUVBnsqzzSwgiF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2