Extracted

• • Target

    NEAS.4b6d9c8a1dadf29aa15401c7c1a402d382bf8305ed6887f77603b2cb895fc93b.exe

  • Size

    688KB

  • MD5

    21a2ca225f66a6e0c61280bb5aa4e93e

  • SHA1

    51530ba354cfe93f393f953049309b9eaf4244e0

  • SHA256

    4b6d9c8a1dadf29aa15401c7c1a402d382bf8305ed6887f77603b2cb895fc93b

  • SHA512

    a70f29a1dff09ca29f7f6bc2e06c2c0c82cfb78bd9fccd080cad9813cdbd5eb3051ca56b5ab80e21c9bc0a476d6173fcb12250be1d202f2b69ee1f1468670962

  • SSDEEP

    12288:iCpvJYIXIb7Ta0A4ZHDWCTEY2yIotj9D49m1WYX7F+tLZurYvDWE3:RvJ1InIgHKaE7yIV9m84FSLZ8kH

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2