Extracted

• • Target

    8400a919b9cb8b3ba1f8b635a24992fabddd5e162e0735c118a9213dc1f71ba9.exe

  • Size

    719KB

  • MD5

    dd39cbc93b94888e04900cdc4c7da69e

  • SHA1

    4001c2edea9b87c32dbc3500b69862ae1162f956

  • SHA256

    8400a919b9cb8b3ba1f8b635a24992fabddd5e162e0735c118a9213dc1f71ba9

  • SHA512

    ea4b8a0c92401ae8e9f68349d4b674674edcb3d57268760e8f7cededba9417961105ff5186ad8b8e5a4a0083d0330a5e533d49a1bb357c945e97b1f1c4d8de41

  • SSDEEP

    12288:7A5WIPr4zyD/dEjE+pt4h69VfeTVvvRSbCDF5x9PgfDvC1FmbyEM2Ws:+gb74/BdgzC1Fmeh2Ws

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2