Extracted

• • Target

    Quote #9773410658.exe

  • Size

    625KB

  • MD5

    f56a805d465621f776501a8cb84e3cca

  • SHA1

    952bcf78947786b7bb4a99844328cf108e8f14c2

  • SHA256

    f47b5a1548d7d1ecf22e19ea995bb81111132ab5543037903f59acc83316fa1c

  • SHA512

    8b60a5cf4a8057ebdbdbf6943dfded7772643a65f4656d1de1ef11de02abdba36567d2442d0396f8bbaa1d6fef85e393bb503c421adf90108b2a103a13a91c97

  • SSDEEP

    12288:fc5q6PbUZ471ebOzQjoKQzgoq1gE7qzeP9Z1tsYK+OnY2:SqVZE0bO0cx0lgZA9Z1+Z

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2