Extracted

• • Target

    Urgent request.exe

  • Size

    729KB

  • MD5

    bee864bff5e11ac3fe30b9add4f72d09

  • SHA1

    6ec2a9bfac903b94e498400bd27027c650127866

  • SHA256

    fc54140655e3660dc45f2582c9fa41f4f957b22f86375e7c3ca723d28004d8f2

  • SHA512

    9317e926eba9c949cee551de7deccf13e989abe48c599d4ce415d1b7cbe12089b04ecc67d83be4695cce11abc407a4013c76108f37f87cc1ffd21cdeb4426fa6

  • SSDEEP

    12288:DLPWR28Le0cY+Yg9fb99uGOu04+IGkpuPLdH3VNx7pApciCd0r0qfk:Dr+xL9Rk9HfOkYkpujdH3h7pApcZ0F

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2