Extracted

• • Target

    IMG_507110293.exe

  • Size

    365KB

  • MD5

    69c1fdf1333790e84965f9534358f624

  • SHA1

    758092a3b95cf4f57d7f9101f2d9c867789153ac

  • SHA256

    5060aa947a34021253ae94af9e4442d1bcaf786214a2d7bc3abf7dbab82afffd

  • SHA512

    b44ea0c51f2c81bb398a560afe7d84e53c94513389b4caba69f1617b7a0481bb76d7ec0cb96bc7a94cfaac1a11ea930380d537d9b47ce8e82b019cc6eeece246

  • SSDEEP

    6144:VUU0X/4NkNzC1iq1bTcpIRVdQhy+skUmKK89HQvsWEW47xV:VDOut+hy+skUmyusWE9

  Score

  10^/10

  agentteslapurelogstealerkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer

  • PureLog Stealer payload

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2