Extracted

• • Target
    be819208ac33c531419f5a12ee2c0ba00e2fe974ad2474528c23d880404d0dff.exe
  • Size 696KB
  • SHA256 be819208ac33c531419f5a12ee2c0ba00e2fe974ad2474528c23d880404d0dff
  • MD5 64dafc9bb267a863b4db77258073d024
  • SHA1 5639e6c0990abbbf35df8b4bbfb1f639f1c55b5d
  • SHA512 f762947447abb454cb56fa87c7c46a228d5540f2e069a28774ba60fd77824ef6550fa8c074a19584d6eaa2571c246c132fc0207bc3fa6630c557cc6f386fb12d
  • SSDEEP 12288:KnwshDhagHCN1fRjSvv3vE+P5t2UlP6BfbxsqqpAa7yUBL0Tlq4DROYbVr6Jcj5x:KhDhagq1ZSv/8+ntPCwLLl4DgYbVr6J
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2