Extracted

Extracted

• • Target
    9b2e17315099fd4f4442500c739242b54f4ab424f809173b9a1bf84de0d28ba6.exe
  • Size 1.0MB
  • SHA256 9b2e17315099fd4f4442500c739242b54f4ab424f809173b9a1bf84de0d28ba6
  • MD5 75a3ad7ba10a98390641b21d90c086fc
  • SHA1 16a1d4f3fd6d4345b806753e5fd14aab69334083
  • SHA512 77cf98abbc289d7e85819829542b67a44275312e31ff2ca0da993af3c1fe414f15813052ef6a466c79b958a3af5565f64383208a88bb7065da241da463ea59c7
  • SSDEEP 24576:op50w2pHAqmtk1z5UrlE+hMsRQF7gYLxFdqhWFtrYcj/P:opR6gztIW++hMsaF5/tkY/P
  • TLSH
    T1313501551312DE42D0D68BB7BA60D33432B50DCF79E6C3929FE62FF738193921968682
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2