Extracted

• • Target
    Grain push barges picture.exe
  • Size 729KB
  • SHA256 0d93db96a7c71d216d6d4cb96abad741ecf89db460d2b32c82049471fa9504da
  • MD5 1db53de564c21ad06380fc078aa848c6
  • SHA1 cdc806d66951637863f9423a600879efc382b370
  • SHA512 a4c691ebf18f0b3a86f1f60a1b4e4bd2bf46c56c90178063144dbb2bb91946d1fdd77fbab5a6eda623039b96c1872ac94aff8295ecb99575e8a73d64cef3b7b6
  • SSDEEP 12288:RdhUe2iNtZzdOusEOzJOfjwaWKAOWcbplxYQ7jqeLU7nAatj/6ireSKv:ZUe1tdLvPfjwaiDcZz7jvLU7nP5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2