Extracted

Extracted

• • Target

    be17427d37337c71ac701effd983f143.exe

  • Size

    1.1MB

  • MD5

    be17427d37337c71ac701effd983f143

  • SHA1

    00978eb4e2325c80bd3bd09b60c5568c4dc6ce16

  • SHA256

    18d2b8838dac4579e0dad6276b13ee43f4de3e85e61e631403b6e149d03ab197

  • SHA512

    99ce9b0df86c144a2044090b1a79519fca87bc53c09dc28e05851b2a108fc0987006b3acc585c3a40e40d7a213242e37a239a9daf456537a5abf39f1938d787c

  • SSDEEP

    12288:iFjm1r/uMqw36u/4xKMAEhp8ALZdStD1WR5/S7dRTc9hvNWRR1yq2:QjebuNk3vrEhBrU65/0QVw/2

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2