Extracted

Extracted

• • Target
    070964628f8a82b5e4f80476803a8f2838a7b5e8f51942679b88cc6c0378efcd.exe
  • Size 969KB
  • SHA256 070964628f8a82b5e4f80476803a8f2838a7b5e8f51942679b88cc6c0378efcd
  • MD5 0f40cc16ea9517a309a2fb636eb2ccf4
  • SHA1 77c73238c36ab251227adecd2471f7417c95f7cb
  • SHA512 0c2d9e420add6fb91838c4344186cb0879ac5bded7cc39ae581e6769bb914640e391edc15f64cc192b1fb9e5726d93026213532d6fe1981195635c8f393dce1e
  • SSDEEP 24576:8fXy5EhUo51EGP+1sT/CuODj59sVBpEY:8a5oUo51i1sbCuO/fsnpE
  • TLSH
    T1E72512086647F51BC82913354EE5F5B423AD4ED9A413D2273FDE2EDBBD32B568C80282
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2