Extracted

Extracted

• • Target

    Statement of Account.exe

  • Size

    626KB

  • MD5

    207031c30119bcb45fed3797ebe387b4

  • SHA1

    1cfd54b6ee2115c711b68bef0067cd19e27aeaab

  • SHA256

    15b77d3d5c89febf03e7530a8f3df566ef66c10b7a9983948cdc074d58c321ce

  • SHA512

    24326c65a6460bbbe1081b4788dbb9cb62ec73db1b1ac1a448232af6982ea44ccb29450e16e16f2e78723ee462d3d9f326e19bdc3fcd7c06aec64fa9eb695e9b

  • SSDEEP

    12288:9KJbVnbYX0T9WXtK9u9www6r/gr1yrhzfspPK4CgVuw35qUOUij:9K734XtK9hwwOYpgspPK4Cg8iqCi

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2