Extracted

• • Target

    S009892823120097.exe

  • Size

    676KB

  • MD5

    cddc8d8aa042a107b1a867b55509c487

  • SHA1

    59d13800e7c6683e0bb790e4537ae8fdc9d591d9

  • SHA256

    4732bfa7244b73047ddfa6759a4b519e8d9335fe1ae5bb80dfc50350f3b66569

  • SHA512

    f904c2add1d0be79c1f2f039ab2a4f8f38dd7791914baf6a8adbc85cd69a218259d75f386c4198c89ccfcc66086ba1c01cb6c0a9c8ecee869e1fb678a1f200f1

  • SSDEEP

    12288:CrqEisUH/hO0cnuhG7XiTGk5IcnqFzVX4Oy6Xf8s7HnzhtxH:aqEWE0cnuhG7X+9G/Fp4OZ0s7dtx

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2