Extracted

• • Target
    765e69564a235c9eac6d724c685066b120cfbdd22ccf40543b3f663427003e4a.exe
  • Size 969KB
  • SHA256 765e69564a235c9eac6d724c685066b120cfbdd22ccf40543b3f663427003e4a
  • MD5 fd8da1f89c9a7e94a811d885422784eb
  • SHA1 d785977f1e09c9a3262d401a499e44c327852e21
  • SHA512 d1adeab207515db056623ec854affb5a33b94b428939bbb5ce0b0693f67f8cc49e9a8b409fbf1e948f97e87a4cc98179987fdc99b703177ddc3e17f7419656cf
  • SSDEEP 24576:KGHXoMLVGqTNEvgIm6C3fYDtUQpsyHlxyGWZ:p4QTNEYIRwQtT9WZ
  • TLSH
    T14A2502456278CB16E4BB9BF91931D13003B67C9EE620C2868FC93EEF357AB505589B43
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2