Extracted

• • Target

    84f0a1001a606072b86d8eca2c4d9ccefc71c38ff71d0aaa2f4ae003f802917b.exe

  • Size

    713KB

  • MD5

    593bb72286c1c2ce5c2456c7d9585a80

  • SHA1

    cb9bf63f9005d5b4f1bcbcf3efead399a1c960a7

  • SHA256

    84f0a1001a606072b86d8eca2c4d9ccefc71c38ff71d0aaa2f4ae003f802917b

  • SHA512

    2fd046fc4730a5e912bfc1cd33cdc2601b159f2b55fbfb86ed6bb966dd5d147586e245bb30bdaaf78b568c814985fc488920faa87fc87d8f9ad0534ab27daf83

  • SSDEEP

    12288:gOd53rD22AAxia+iWUd1jIXbsZ9uXIfa5vWwRkP/l14zAFDQzjgWaqPK6k3LlYl:NrDa5a+iJXIr89fOmnnDQf4bP3LlY

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2