Extracted

• • Target

    35befae36a2f6c5d15da8d5ec83ffac9d42e32ea67a63b42fe9e230c5bd97462.exe

  • Size

    710KB

  • MD5

    0a0b853e1544847e49c30c294d943460

  • SHA1

    0bc8644d0eda5097d807d52c783bf553ae584dd6

  • SHA256

    35befae36a2f6c5d15da8d5ec83ffac9d42e32ea67a63b42fe9e230c5bd97462

  • SHA512

    74b16940ee083c81a57dbc3d558362be2c4f4a540d2a06631836d1b269798aab6fd0ddd262d519eef27b9279881249b307f5c9f96713ec8654f1dd0fc4abcc93

  • SSDEEP

    12288:Qs8MvvjpkDaBs/yy8uBoarO5O5TCD6VG4nfvF3fq9BdPA5iUiCCjDd9MbNhlNBT2:+MnFTaajsOzN4nlv6VA5iLuzlz2

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2