Extracted

Extracted

• • Target
    SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.10101.19878.exe
  • Size 680KB
  • SHA256 621425400cfcefaa6e9f1bc2bbac63f8b4aa23c81c9b805098724c73e5031021
  • MD5 e7a754f4ff9e4810129115888bc35f6d
  • SHA1 d527266fd29c9f0d545f79873bfed283aa129d91
  • SHA512 7a8bfc0f24f094ef74776351ea84dac5f1582f2bbcb5cd810669de0853c72d93aa674431d935ab420e667db3409e89bedf5f11b638b89684388f3ae812849276
  • SSDEEP 12288:2ZXrQyVhJDX29kJQIdxda7jP0jkLfiXZc4Sa7IMBTK:O0yxz3TBGT0ALwSa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2