Extracted

• • Target
    SecuriteInfo.com.Variant.Ransom.Loki.24223.16382.9455.exe
  • Size 862KB
  • SHA256 09581fc9ed4ea3eac091a119cd524856ef8a9236c54b3269c3c7898d380b2a4d
  • MD5 f31b0cc216020164c0f573d1c0ec8024
  • SHA1 8e3be6f01deb2ac6995cc0f3dc687412b722beae
  • SHA512 cb8657afdafbdb70ed909e707101dc8e913c4e73d8ab4ca724b096b98ddf85b12f02dd871961bf85a8565a4c9f27e5fd8537dd98eece475cebee74ac6b6fdf40
  • SSDEEP 6144:cr0awcsfOqeazCR9aYuiAUDAe57BMrwvQ9ublOgh6upQP6mkGHcCgIpZugDtAGIC:3PTiVDMrCE+ZrmkGHZg8uPxwp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2