Extracted

• • Target
    ertyguhijhgf.exe
  • Size 1.1MB
  • SHA256 d58139c7219be351d742a21fc35150702bae9ac2023a7086620521f1721f2c49
  • MD5 52fdfdac4eb28cc5f0f709de00c1e527
  • SHA1 2a54e5da3531992016fcf0ab7f6f284a122712cc
  • SHA512 56d0e7f7acd24f843b24beb6e617e3962de32207df07d30c49a0ceaee2e0b5a12e3b64caaee7f9918d76f947e726ab92c0eb04fda01165a47874ca61074897d4
  • SSDEEP 24576:ahd94Elb0HsBsxpbrqKR1N9UwyOjMG9bNr:+d94UssBsTbFN9UwyONdN
  • TLSH
    T18A35CF287DC6894DC5384F76C6735B8833F1DA4ADB82D70BBEDE30A8891E796C501E16
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojanadwarepersistenceransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2