Extracted

• • Target

    00158048022558621.exe

  • Size

    678KB

  • MD5

    8058fc91a2fb25f68844666f0babfdd3

  • SHA1

    cd16874f02c71ea7fec3bceff54532e70c7152b0

  • SHA256

    295b33ab6ac30b1a9cfe34fa15078e824635fe92aee746ce4882766d2060b5b3

  • SHA512

    158b8d7d1a557cea9310e307d41b3d2d4261171adaa7cd09eca50430f5767c8815cc5ed5e671255bf710507cc90615722ad9db2f4d229095beae67c2f98f7aea

  • SSDEEP

    12288:2BhdQCyrzWxWreQRqf53zxeagDSN97vBBL8VlRz+d7BR6wT:23dtQzWxWd6UINxvBBL8/cpB

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2