Extracted

• • Target
    SecuriteInfo.com.Gen.Variant.Nemesis.22775.16398.31863.exe
  • Size 368KB
  • SHA256 ada8b68992f2e54fecfd3a003562da77b9d643f3cc1acb1fe1f2560a32b593db
  • MD5 fb374beeac9dbd0ce642063538e54cc6
  • SHA1 60f2040da623c0335fc2a1d6d581ba23ef8c196a
  • SHA512 631ba1d9a8743fa19d522bd0f42e2a27238cacfe9118df8700e5e083f6336eb8f4d3505f8d1901aed3a376e07e5536afc04f42b5eaa1e6c46426a99d5ee2e3ea
  • SSDEEP 6144:/Ya6kJ79gRGpOEbepDpo5R5oQIK0uZrvFeq/0GHSUs9S3PEhQqpUJcFb9N:/YKRda7o5Rb5rUats9qPEdycFbT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2