Extracted

• • Target

    Product Order.exe

  • Size

    776KB

  • MD5

    dc864332ee7a85324d0cda25fac3bf21

  • SHA1

    5be0e586e93b9042f8a72e1c1bb1a5182a4066d3

  • SHA256

    8aead2c3d3796d348dc61029023a5679f2ef747c8ce155a767d5e47280e5ec26

  • SHA512

    f02820ec93fc9f4794e5144986f9defa41a5510c758f43273eb6ad7d0b9ad537ebab5cacc63ea705152eb514572abe345db29406d4a9fabddde6b7cb8ee1e1f1

  • SSDEEP

    24576:KiOV/NOapDl4JebJgUte4/pB18/dBrZNx2JBJ:KiOV/NOapDlpKUM4/po//rZz2JBJ

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2