Extracted

Extracted

• • Target
    d027dcc4aeb650adbe3fff5c124a96cd09d6d2c3eb602f74dc547dee735279fc.exe
  • Size 1.2MB
  • SHA256 d027dcc4aeb650adbe3fff5c124a96cd09d6d2c3eb602f74dc547dee735279fc
  • MD5 879755f6241bd455df7d06af9c8ba720
  • SHA1 1817cefed6bd7399fc73bae311eaac0ee7089be6
  • SHA512 98a53c41cdc36d4bfe40d38bd4b4c5783483b4e83e9f0cf160fa2d16144931a82f86972c4cde01dfc797d2b60128f1f4438238fb7b0c76b4f8088004806b3ba9
  • SSDEEP 24576:Ap50aXhTPc8plqc8TEtGCp2Igp4G1oRybl82s0O8BD48rWHFDW+1RUr:AplhVUcfp2cG1ML0O8BD48rWHFDW+1Ru
  • TLSH
    T1644501801255D845E0D68BB5BEA0E63837A55DDF39C1C2AB2FE93FFB75B97830044262
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2