Extracted

• • Target
    5f5a651b70cbc2315ca3ac61856cfab551119849e1676729f51a12e558e7d68e.exe
  • Size 1.1MB
  • SHA256 5f5a651b70cbc2315ca3ac61856cfab551119849e1676729f51a12e558e7d68e
  • MD5 0c2d59652cd96474c1c7cebe66860aff
  • SHA1 a2b8d375363dd0e46721facd6cf061cefe23062d
  • SHA512 e6514d1cc1889cfa2ebb28d575e4dc21ea412ba05bbea0734e49aa5f313de35635d9541672a565fff9daa48b2ac1da59d4d98bbc79d1d26462644bae7496d8de
  • SSDEEP 12288:RcMUHYwDc8u6GLUEUJlDODtj33K5S0/cR5P+KDOHq4TOEXgc7SyTYOBRPlxyLS/F:gODR3ReHqCOs9Rtxr/vS0Lu41UI
  • TLSH
    T1EF3512196A89DC15C5E207B564F0E33863F77E9CA421C21A4FECBEDB3D12B025D18B66
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2