Extracted

• • Target
    gvailantzx.exe
  • Size 616KB
  • SHA256 0d03f0e57bfc9a9b4e583404b127ae9adff260762252e77d11c95bc6181188ce
  • MD5 25accefa23aaef221d171c8799a73fb0
  • SHA1 8ee88879eb9669ee3b6419b6545fdd9fbab8c236
  • SHA512 729877dd6a3b7212cdf23c68d682dfccf562f7c7f732bfe83e5424746f7a920d10e41c20c1b740d663753766bf70fda8dd06b7f89a2a1545f166513491be6293
  • SSDEEP 12288:9S6ln+flo/XciMvmFg+wR8jIm2x5YDhij65tmDc1:0TdCjEmFYR84GQj6qa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2