Extracted

• • Target
    487fa93e89fd1ec0969e0083966714bd.exe
  • Size 924KB
  • SHA256 08bef6d15fe30410b624cfad64ba2e410312d8bb03fa602a31b69c91dd307147
  • MD5 487fa93e89fd1ec0969e0083966714bd
  • SHA1 9863eb9fcca5e3c1befb4a11f3ca6ab3dae6cda8
  • SHA512 606638ebaf1e60001d1de6e4934a57ce402aa181266357b12313c2b31a0726ea53b549f845a624a456ca08cabc9c70fd1b76b242379e8a97e79ef867582d091d
  • SSDEEP 12288:7jYnlngXMUZZ7FMlyXEc4TZyTxsltRuLpcXvZKZFBYfdO:PYneM6uyXEc4TZyT6lKmZKFYf8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2