Extracted

• • Target
    POWRPROF.dll
  • Size 1.5MB
  • SHA256 80df68273b763bbd74207d708a49c4aae244a6cc85161e2efae0d73f373830a9
  • MD5 d1f41d50627a69e02d4f7464beb2f8b8
  • SHA1 ad383fe7025e956bce4458cbb0106f958489bf9f
  • SHA512 eb08d59c81a9b9bcaacd6b69a941f9bf0cdcaf554f0743d423d3e8f93cc31e466255e683852d101cfc3cc4ccfb7a4e9f6110cd8c185a8dd355de1c01cb23bd95
  • SSDEEP 49152:wNOXMAC2AQdCbs4BPfxFJZRahJZCdC7vr+ad:FGPXJZRahJZCdC7vr+ad
  • TLSH
    T16B75BE55B3C866E9D556C9348715B733D2B2B82347A2A0CB0A9ED3091FB7AE15F3E700
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2