Extracted

• • Target
    Secur32.dll
  • Size 1.9MB
  • SHA256 82e46263b574405ac2fb3052dfdfa24290aa422357a662edcaec5eef94bc5060
  • MD5 c3148a215891581766eb7ce9dd0ac1e5
  • SHA1 f93c9bd9d768c3540cc31338474810c3f517b8f9
  • SHA512 10bec114dde86752fdcf25f4c3610376cbd0a6e8bf9a40697d2b38b532b5a362449f8bd0c51cac1ce1dd15d52f3b99606d0a4ce0eae10fbeced42a319fb89e90
  • SSDEEP 49152:r93Qdb+Ugik5XVuyue6H9Yi6qVS8bI/IO9:+Dktpue6H9Yi6qVS8bI/IO9
  • TLSH
    T19095AE06F3C416B4D55FEA34C61BAF32D2B2B8160735A2CB1E95D7492EB2BD50F3A640
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2