Extracted

• • Target

    d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09cexe_JC.exe

  • Size

    643KB

  • MD5

    3bd08c421079b536a25a8e5f7d03d3d8

  • SHA1

    d5c826f9411ab8e5429576489b0d8dcd32f30113

  • SHA256

    d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09c

  • SHA512

    749240952b26506a37bc237d99e8af8b2afdbf7574f26f6cb94c27dc9086a42daa45e86feccdf7d3ddb591c7a95f8f9a77b942c1b2820f0a18e08917b328890b

  • SSDEEP

    12288:/JysnoROJN5Kd2wUc2G4OxLm0hrqlUTOjOTCQSBZ7J:hoqN5KdOc2G4KiYqWwZ

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2