Extracted

• • Target

    1d2e530be1bc9a98c41429524a89c79e.exe

  • Size

    1.0MB

  • MD5

    1d2e530be1bc9a98c41429524a89c79e

  • SHA1

    bb11e3ba94fccdd21877c7180298c1df4f22d56b

  • SHA256

    fb79bf743f1d8ec783dffc9e68d31bbe19d8f26954bea74ba81b7842ae36a820

  • SHA512

    8ddcc3cbd113f6485ed6867489be2e1af0770e15b245fb5826248c6a6be5d230461e2dfbaab14d517588b781608591c73f7270ed5ebc684721aa2893e0670f37

  • SSDEEP

    12288:tUERECXjZB22OBZSw/dSamjZkyywVPjZtYx2jal5+MDfoRVmhOAPxysgzfkBKQza:tUSRz3LOjt/mywVr8

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2