Extracted

• • Target

    52f7df04cb306719eead0d602947612f3b909ef4fba8029af064891882ff4048.exe

  • Size

    672KB

  • MD5

    c60b9db545c718ad3d65325523ea0bb8

  • SHA1

    1a46506a85efcd0f94bdb1e9101712d2cc32bc0b

  • SHA256

    52f7df04cb306719eead0d602947612f3b909ef4fba8029af064891882ff4048

  • SHA512

    92f13f4bb59c396010cc518e875439b28c45bb34a35c2fd955332614be9e4409e2b81ab7a42f3370457d853e38acb33304789c1e9fe3529c72f8f69bc1a7673d

  • SSDEEP

    12288:56fLHuqbgStGg2LgBskzNKDTS+wsnvZ0JfFYqohMw2aupY+JCw:56fru9LObzNKDTdbmJdzHwD2Yy

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2