Extracted

• • Target

    3ad34ce31f7e3a9a6d946d8ab7415e57.exe

  • Size

    610KB

  • MD5

    3ad34ce31f7e3a9a6d946d8ab7415e57

  • SHA1

    7ebf02688d73ef949367c2597ff3e55dce699c81

  • SHA256

    89615850a0b6561bbf1c4402fe8ca95b4052f49ebd4a20f0e3ac8a176859ec58

  • SHA512

    e52f5c3d088d096d5412716a0da2f2dc7c5189960266e9ec6d01c31191a511e565630f8d59f4bab235059a1e3506f698824204666123e8c2e89e7b5da27fc893

  • SSDEEP

    12288:V2dkeJDt4V1Jzlz7+4IQeV8pXq5xBpiBbU8AM+GmfvW:VbeJDt4V1JpaC4wbOGmfv

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2