Extracted

Extracted

• • Target

    Joint Fortune Shipping-October-INV13463.exe

  • Size

    658KB

  • MD5

    c29c1375b79b2a39a4092cb6946e3f28

  • SHA1

    e99466df0037b2dab766e7b158608221b2d20d1c

  • SHA256

    e22a20c2e0547c6f4005ee9880587503abb4cb087588c7d44cc2fb90a5838ed8

  • SHA512

    17d04a1b24df1cc55d0325d77cdaef899e50d35254fb8d7a14443e909cd6416f35da9ab290d1fcfd13470efcc2377447f5da7f7f97b3022de1979b545c7dfc3b

  • SSDEEP

    12288:fXWv0zKz2UOplarRlrmV4rDw2m9Hvw0//PuqCDk:fk2XwSVuwFHvwS3kk

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2