Extracted

• • Target

    e8c89752942b8011820e9d04753700eb70f77a8701796ef7e826399cf889f9ec_JC.exe

  • Size

    565KB

  • MD5

    21cd38786ccaee7305123707ced27f43

  • SHA1

    f594e2f6ec6f8a93542bacfb244c36705086af1f

  • SHA256

    e8c89752942b8011820e9d04753700eb70f77a8701796ef7e826399cf889f9ec

  • SHA512

    933f58794d04ecb59216b41e2a809b670a6e83e89d4f8c8a636868614b4f38158c926613736e9cca52be4b7376d54aedf7e9dbd529e169b6ffbfbf5101088c63

  • SSDEEP

    12288:eULPObnA36hOdWkXyoceEfP0bTqLpiXUhYOapXcl6kpd2rH:3LP+DOXyoQ0bTqLbhNjpd

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2