Extracted

• • Target

    3702d77895124b57140bce0482029875be25274a2c30ec6d8fac8bbdfcd92394.exe

  • Size

    300KB

  • MD5

    4fdf9741c120f25e66ba4cf07067c5d5

  • SHA1

    7edfe85c45ead131f31f158c6c4ba2ef5f6291c8

  • SHA256

    3702d77895124b57140bce0482029875be25274a2c30ec6d8fac8bbdfcd92394

  • SHA512

    0a2194639ae4870cdc4cbfb74e3d7a5e7a5c24c22f35d1616acdcf0063d82e14d7b0c7b04427321b95d3dfa283970e0f4c90b7732d4cb1232461e06ab19d45b6

  • SSDEEP

    6144:tqEttR2Nor0fA34WY4bBdTvki2QMqoFZRGILs1UbEIIRA7C+iwH2:nhfY0BdTsQMhFfGIxEIIK99

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2