Extracted

• • Target
    _31d293ffa5e55ff2df504ab951b785e902b335974826a9bfbcd4dfb29ab59068.exe
  • Size 1.0MB
  • SHA256 31d293ffa5e55ff2df504ab951b785e902b335974826a9bfbcd4dfb29ab59068
  • MD5 e634daa853d4d5a55ad3ee5d20d336a9
  • SHA1 8478c8424b0ba031bd8b911e2ecddd344ce65a1c
  • SHA512 50e32fff1b0c71705bf6f73c618f3ce2ad2da45cb16b415e63bd69737727bfad952c8a972dd2ac75103873d9f46a72d2308d2ec6989ec6e0eedb78851ff9d4fe
  • SSDEEP 24576:tsZkYeJaaAsAw3lSwKgxKfld7jS9UMQ5YWE:WZgwMEg8DXGPSE
  • TLSH
    T1CF35020423E9CE02D0BB1BB06AB0E27117B42D94E962E34B4EF6BCE77D75B165815393
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2