Extracted

Extracted

• • Target
    3aa519838c38d7b056b5cc2da23cd0dc26883b8100414b09942af1885a1aa57c.exe
  • Size 994KB
  • SHA256 3aa519838c38d7b056b5cc2da23cd0dc26883b8100414b09942af1885a1aa57c
  • MD5 27ade9b15e4d61ac546ab57f8cb82982
  • SHA1 945b94aaa57efe52fab7be0d54c7dd2a4d9be746
  • SHA512 9ae5e710436a3ca36f7731894314129fe0833c98ae9dba025d8fafb38eb6e4ae4b127446d8c78de3ccb78ee4ec20ca28b9b47065ff3f17d7103a18a61b7e1b9c
  • SSDEEP 24576:K+p50HS4noeqO5bOfP82pBt/7195buX7IGQNwVtEJdNB1:bp6kcipL/X5bfGTbu
  • TLSH
    T12425F1142356DE12E1E6CBF6B860D77036B50ECF39E2C2D65EFA6FE7381A3811544682
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2