Extracted

Extracted

• • Target
    5b7146ddfce30ff5d5c8215ba0ba68544726a03da31bf3074c4086587fda1370.exe
  • Size 1.6MB
  • SHA256 5b7146ddfce30ff5d5c8215ba0ba68544726a03da31bf3074c4086587fda1370
  • MD5 0ad93109b547084f43fe09682c4825cb
  • SHA1 23795a745385b1444cfe8618603f623d686573f9
  • SHA512 4e68839ac4ff39bdb4a2bd11259fd283630f0014175a58806d0756aaeb66d9b54d201d7c982c3f27cafea4fc768054cc9b565c7fb6d570f98c6347b41c4dba8f
  • SSDEEP 49152:laoiHL9XmTJIlzxbx49AsvRo1gh/x7ZHOZiNBf:laoi5XuKlzFxIvRDh/xZHr/
  • TLSH
    T1AE753341F4C4AFA0CC2D0BBC6FBE9DD87B9914C39BE435218EA4D86D4D31DC9A6B111A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojanupx

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2