Extracted

• • Target
    2112d749000ec32a1eeb719eb1e0daee69cda7946eab3049f5d2fd83bac566c2.exe
  • Size 1.1MB
  • SHA256 2112d749000ec32a1eeb719eb1e0daee69cda7946eab3049f5d2fd83bac566c2
  • MD5 d8d19575c1de6c091ebf0624596478fa
  • SHA1 22d0daad3abfb17c90862ac3fd80746738c9074e
  • SHA512 277ce3a2e321473970e5b3d967d90a602378ad9ea17b373813397a3a05957995fd6d3b06575a264af349ea35392619abec174923a0e10458ebecc530f750a5c8
  • SSDEEP 24576:vCT93VZbQs9fP6p4g8MFnKw8hvuB64pILCbUse7NQ/aGuJK0B0qx8EXb:ap3Vb9f5Ron+hvunCLKUsQNQ/aTJK0B/
  • TLSH
    T1753512285A89C811D5EE5B7950A0F37D13F2AE48E420C71A8FECAEDB3D67B015D18B71
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2