Extracted

• • Target
    Purchase Order.#01222023.exe
  • Size 727KB
  • SHA256 dc7f9c2cbc0466c884b6fcfa3430a74b2e582446e4560133495cabb5ce05c940
  • MD5 e263ad234a3af2cde6efecc6fb9682a9
  • SHA1 801ba9e33d2d11e2ce2282f8fdbf530b6d065b19
  • SHA512 fbc77c407a5e7af301e5a9f58b7f4cd05c20d98edd67b19b432da595437ad9e17ad89d5e37941a71e948cb3fec28d66502db91c410c0e979fa3b181cc869e05f
  • SSDEEP 12288:aJ4adp7tL+NotoZyzveXzpB9B68QwYYgGrvA9dFSwtBOoIL:2p5NpzopB0SAbdO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2