Extracted

• • Target

    audiodgs.exe

  • Size

    739KB

  • MD5

    7a9336c2f3ed97231960fc993881c6ad

  • SHA1

    5ce3e982826f7f94928f31fa90daf890ad913eca

  • SHA256

    5b5bbec5426595d0b6691f19add610017e667d14445e6d374c9c7e51ff1826cb

  • SHA512

    5190e7e40eba312f4265900dca0f1f7a41b927f09f26f906a771f19c6da8202d7df7decd2649832a776bb7beecd9103557afcb805c7ae9ada6e7090f36aafca6

  • SSDEEP

    12288:DO2iN1BdcmgdtDj7y6vNfLhupgc5pN6dxzC8MBa8EUtF1fUladqfX6NFvsmv:DO1nMmcM49MgEpNexzC8uaK1fUkdqkds

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2