Extracted

• • Target
    052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536.exe
  • Size 1012KB
  • SHA256 052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536
  • MD5 a8f7de686ac1cbcebe22bf17ef2e85a3
  • SHA1 b6f1d854a1346fd8b2870a4e64bf865fa55212e8
  • SHA512 9cf96299a4b293d07af7cf773c4c3701d086fba7f53756d40a505444f6d0d3910e6d7eee719fb110b12ba0a0481cd654f2aacb82dd769e11e1622a42ee00c5f5
  • SSDEEP 24576:ecCp50zkogy/qk9fq9AZf8caPbwvcZRF0y7C4W8CGzPK2lII8:ecCp5kykeAZf6DMcZIy3CGzPKYII
  • TLSH
    T14425F104235A9A42E0E6CBF2BDB0E37033641DDF78E2C29A5FE95FE778293815454792
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2