Extracted

• • Target

    file.exe

  • Size

    589KB

  • MD5

    c0af1f322029601e938f7775cc6e8a7f

  • SHA1

    9f6d388c75fe807d1228e2ddd9dc5d5c49ebf3fb

  • SHA256

    75976b1d7ab35aee3b84e9180a6776247f0003041b98fb2ac8e99e46eeabd274

  • SHA512

    e0e1b5216079006ef6a2e3ee7117dfc793f5265445d7ee0f6c73c4a4e64941152819dc70b69dc61bbc8ac0999694057a4aee5bc43ae51385cf62b283e61acd4a

  • SSDEEP

    12288:WOnbqjcvdapIVHhjyA5T7Eofe/k7zhGkWoYoXb0CHNt059uBJt1:WJadMIBhjyC3Ese/wwdoYoL0CHNt0TuX

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2