Extracted

Extracted

• • Target
    PO#241001759.exe
  • Size 729KB
  • SHA256 f17b902f094220be7501fbf02ca5e258de6458939b097f60705f8872fc3c73b7
  • MD5 41d2427d475c087b6742c8d3881b3847
  • SHA1 36d9144f3b2cb8b8f72d7e20c0f7b20cf97fb7a6
  • SHA512 93716040d79093780f93a9a4448048c2c1d1819b99030c3d27003087b8cb7dbc3183d1afab88437f9108ca70ce6eb7d585847ab0580325dc647b155daeadf5c0
  • SSDEEP 12288:INeOQx3TdpCmdIdL2/2gHecoI/v0b24w135wltCE5UrMkpOTOudkdRsoBiQ:kixjdpfId65Jn/r4m5wfCMop6OeoR/EQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2