Extracted

• • Target

    Order 1204230034.exe

  • Size

    699KB

  • MD5

    c43d682702a87692466f6408a0c07940

  • SHA1

    94bbb628c5610add58fab1eedc38d18d69a7c9e4

  • SHA256

    4a7a6ec0cd99d2da72908fb02039f53ccce070f1d4562c9cc7e16b035bc963c8

  • SHA512

    759e9107b67c5d210fa146e1e135ebd2a369f5d75c845dc6dccb9db1663794b7edc34a930069915688fa98c4040e4e8fc6ec6552e196ab782c0f2a74ee6cc865

  • SSDEEP

    12288:yDWqcP45+po2OME6rETuhb2EA3kmZ11o9z0YfXT0/nZ2E0LjeCfWHCr0wNy9WR:Kdz+pJrCy7mP1oTXT0/MESzr

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2