Extracted

• • Target
    076556ad465bb59f3c94c5bfc5432af05b8bb41f8cf65fe72f55b0f208c17aa9.exe
  • Size 784KB
  • SHA256 076556ad465bb59f3c94c5bfc5432af05b8bb41f8cf65fe72f55b0f208c17aa9
  • MD5 8bd1824cb2c839ed25f116341f787214
  • SHA1 c911067a202ba960a1f9d7a192cc85b63befc96b
  • SHA512 ca6009f578a22bbdd9709f53c7848f115d6ac7f44550764c88327e2dd7cdc394ad4bafa7d79af9649ecc62c77390c675b7b317b74d8ff3c96682159f1a1dc216
  • SSDEEP 24576:1d4qXdVEiz7NpLg/uz2SXqXwUVxSQQPs:r4qXgiLW65XqX3xhQ0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2