Extracted

Extracted

• • Target
    Bank slip.exe
  • Size 695KB
  • SHA256 86f0d9e69171fdf591af6df81030e4debb2710a2b8e59807862f50f27d79531b
  • MD5 c695ae78073e735f93f211fa7212fcda
  • SHA1 9314cf9c099571791f494c788c50eb506989d583
  • SHA512 2ae35cdb08471f16dc0086bd8768a8e613ec52ef4f1f5d713137ec6bab72d1f908d0c3fdb45bfb7e4616ac5d1d240519950db5b7b1150776dd578097cd450ec6
  • SSDEEP 12288:PhogieSATMH5DaUaQ1i68wA/PfvPwFdvXbzP4+8zEZowAauGn:ZogieSATMgQbN0PPwjHX8zE+wAnGn
  • TLSH
    T1AFE40128153B8A02E5B27FF01D74E0B4677A6CAA6130E1685FD21CEBB5777107E4272B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2