Extracted

• • Target
    _f300acb388f24f7a14a4303504490649ec3e1b66632671d08513aa10daea1bcf.txt
  • Size 3.2MB
  • SHA256 f300acb388f24f7a14a4303504490649ec3e1b66632671d08513aa10daea1bcf
  • MD5 f42da34b415a43dc20fd7404793c8eba
  • SHA1 d2c0a308e908652d81a601e81c4d81710b3e1387
  • SHA512 8e5ff68c4ad47134f4e9d6ab8796edc0c77479bb9abc4878929ef234b23dbced972295d0f351a8d563ca3279da782820b1d77cb5dc859e6cc0745a9a25f2d3cb
  • SSDEEP 98304:gEyXmf2seOF/hWXWh6yhXPs4QNQzzeh9rqUR04DrmvY/sVbmMq6j2zUCxlbN4yr+:MqT/NPsSAUjwOgI
  • TLSH
    T1BAF56D088664F38694ACCB64CC0DBFED461DA447EF34ED437A1D897C9A48F82B6447A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanadwarepersistence

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2