Extracted

• • Target

    NEAS.e0a14b9acddbf73d270c2eabf671ce58e1c2aaa237ccf2de320efedc947b6ccc.exe

  • Size

    639KB

  • MD5

    6f2b2f1d2660afb4706026e7d7d23aa1

  • SHA1

    923f3343f31c12cfcda499a777944ba8e140357f

  • SHA256

    e0a14b9acddbf73d270c2eabf671ce58e1c2aaa237ccf2de320efedc947b6ccc

  • SHA512

    514729c48f46cb8db71d125105fd4a00cb67f9e4efe42f51c88507a262fe230a5f41e00570734e745489bafcf6ac8e0d1a112ba71dbebff3457f8b5c9fdfb388

  • SSDEEP

    6144:iCvHrm8ClZP6C0Cg+5cbSfDL8twf87vi2Nzm6aY8OFTglKfNzUjYo5jN9vTYY+g5:UjDLlf8aY8OFYKVzU8GL3w8FC6hHgB

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2