Extracted

Extracted

• • Target
    f652ff62cc4b617cc1faf81f1d57a192.exe
  • Size 741KB
  • SHA256 eb4b358d784a43733f3b307b562f7d3282cc07d94be7526cd8600bf8a4bee530
  • MD5 f652ff62cc4b617cc1faf81f1d57a192
  • SHA1 b3b8ff7da51234c67e85751e31fbbde003a7a402
  • SHA512 b9bc3e54da6ae188c2c648b3749442a50deba5250c9bd1b68edd9a3bfd96b0fe84016be74b9a755de20555a40001b6ec1d78fef5b6bab15cbad82885da601aa3
  • SSDEEP 12288:Mt2iNyOe42KMu/N3mWhQmwmJCMpUEASF7EvDa02zozNhjBL3FKivHCAwtieNloTI:U1wOV/NOa1AS1EvmsHVKifrwUeNGf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2