Extracted

• • Target
    1203b91790fca9a278e54674db530c661f7f6a1e885e2844e9811e1b5c07d66d.exe
  • Size 928KB
  • SHA256 1203b91790fca9a278e54674db530c661f7f6a1e885e2844e9811e1b5c07d66d
  • MD5 1e69c9a58d6be0b71a5e12425f79e66e
  • SHA1 bda73d3d6cd2b5c9386e8048a08d2ff3db865a02
  • SHA512 89c59cc533d9807faaca0e471a7719b78a1340683331a85705ec1c531cb832339ebdcb9b65da585ab9c8d73ff3089f9ef436d546a1268c7549048db8f708ff06
  • SSDEEP 24576:hrj/Og3JCfQur+ThyrVyjQicLyhNKvydzVEgOHs9:h/PZCfaMTi+yDKKdzVEgMs
  • TLSH
    T17C152251FBCAEA22C3825BF40EB6D17A13348D9ED831E3578ED7DCE77089A112494762
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2