Extracted

• • Target
    1ca6c053e788f8ea1e1eec1c712cf0ec5374ba5d8caf432717842c702e3cda0e.exe
  • Size 704KB
  • SHA256 1ca6c053e788f8ea1e1eec1c712cf0ec5374ba5d8caf432717842c702e3cda0e
  • MD5 e2f6a376216a6492d6fe3648a969608c
  • SHA1 173744067f87c36ad289d5302d5b7bb3c6a36ff9
  • SHA512 bc7c6fb79d968e4fdc699b2c32631b147cb2d8e64f2077f3767dc24e15dc7367398343f281e5765aebfcfdd3baa94a4e6c2be6a69bdce4ed58e7376403957c4f
  • SSDEEP 12288:fPOwaHUM630JWrQ+W5Veb6T63t8JsqbW6N48vJ5ghVgXwwe:ewaHUM6kJWMx5Veb6at8DFdv7d
  • TLSH
    T1EFE42322F49DA6E3C0F95E331C76096B93BEF4AD850ADB5E2E825154AB32704C52133B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2