Extracted

• • Target
    486ea58428834b55490c2461263c3837c49fa6babe1ccfcefe8c4f52d6c7a93e.exe
  • Size 649KB
  • SHA256 486ea58428834b55490c2461263c3837c49fa6babe1ccfcefe8c4f52d6c7a93e
  • MD5 3b7ec5eaac48ee385d926a78e32f1e88
  • SHA1 67bb449007baec692c0acf158f2435d3e2d7800f
  • SHA512 5cc3c52cda659a6535ee6fe39ad8130c772acd1ed6c390cb92b953e717d1416cd2f8c9b5c4772b462a28f55192e156dd23f17a80dff6688ef0a3774c2d15cfbf
  • SSDEEP 12288:CVaWcqfgY2/kX4/xd1s26j1Ha59Y3DzJbEsm2g/k7EBNY+zEt:sH2RoZO9YOymBm
  • TLSH
    T1D3E412195B84D947CC5053790B31E2B56B6C8FEEB422F3068EE6BDEFF821B246944193
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojanadwarepersistenceransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2