Extracted

• • Target

    d5d18f9417c9f5268a707e6c276d8318f0bc399302ff07d8d8319257c9dac063.exe

  • Size

    562KB

  • MD5

    ebba07aa50ddef78d9686de42b4db3dc

  • SHA1

    8060a6eb32751bf7d909e0e5d25094a9c8fd7bbd

  • SHA256

    d5d18f9417c9f5268a707e6c276d8318f0bc399302ff07d8d8319257c9dac063

  • SHA512

    9e3f8656d4eb07f4c6ef38d1c570c8ee66e7123f67cbf6bf0ae833dcfd66f8841bcaa653a5f4ffd7c4176992751490fb32f9dd31a196a9379c7a075f2e4a4f12

  • SSDEEP

    12288:JAOvIzAPbIs69NzYDdGi3y9p2L7iDu6pgbeSHtXqjfXiLsHiJI:JAC356X8DdhiT2UuTJHtAfXiVI

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2