Extracted

Extracted

• • Target
    a0b8d0c6f8478a8082dead050ea904f40f6b7b5149a908a473af6f2ca6572689.exe
  • Size 1.2MB
  • SHA256 a0b8d0c6f8478a8082dead050ea904f40f6b7b5149a908a473af6f2ca6572689
  • MD5 1c493b656129ad087671e0ef1c1da22b
  • SHA1 5698a2302c4839edba3ecc006a11eff51d9e5ddc
  • SHA512 b34bfd12d94fb20bf6202298a9ba4a38c80dee07a39e12380c92b1faf60a47f411c1b75f1f746fd10a336393a392b3c16086a49c7c6416d3409ba270bfc6f101
  • SSDEEP 24576:IRp50F25dz+eN86SMqtB7uflf84+Ce/Lpr:WpO2PhHSMqr7SJeTpr
  • TLSH
    T18145E05036238C82D07B8BBED861D37416B44D8F70A3D1DB7AE82F7738187C9458A67A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2