Extracted

Extracted

• • Target

    1214fcf60b88a08f596efec828f1ea8744b30aa6ff141c8a98f45dc6b2a51658.exe

  • Size

    137KB

  • MD5

    3f44e6cb225efe5b640353f568a99acd

  • SHA1

    89bbcdf4a0c1d210a656b007ae3c754367ba3bc1

  • SHA256

    1214fcf60b88a08f596efec828f1ea8744b30aa6ff141c8a98f45dc6b2a51658

  • SHA512

    7765f7e653c55e4d8034df89dd7584fc787572e3e7d5a38fd5744f95b435598707e26feedb7a0a8d9fd48404598cd7857d52bcfed1b57434acd6bc5428accd7c

  • SSDEEP

    3072:duxPI6JmMvHaXQtMJo+rEG7mAeedlZk52/Id4r85fwH:dgSQcoHG7R9Id4c4

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2