Extracted

• • Target

    HTML.exe

  • Size

    581KB

  • MD5

    0c86e968796f80b0e5c091b3270ce88b

  • SHA1

    4b8cac21c67d776a6f1e834191b6091236248e73

  • SHA256

    cef638c80808c085c6ad3382a2c0d1f664a0cba324a178fa2acdd572a193eac5

  • SHA512

    fe13ad7fd9ffec5fead6a5e4b75208f9ed2bf9edf70efbc324d34711f1b60e9feabd34a3f74f00a9b6b4f160e524eff9f4f3e795f9ab5b867d908216ee3e31d4

  • SSDEEP

    12288:8awpemS7q1GV1ysvF5kJEqD1DqbQpkMwuINF9ypvrab3ZTsGD/si:8awpemS7qM6sd6JdpPpHvlabJTe

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2