Extracted

• • Target
    Attendance_May_2024.exe
  • Size 714KB
  • SHA256 4210e25c33df901302fe42704fcd0832729e4efade9da5abe6a8f2512244024f
  • MD5 f8fe6881e21dcba5b78d693f96f56c6f
  • SHA1 15bad9cbbc0bb09e66ab78929a5ce632da652b78
  • SHA512 e0bf8b7105cc94bb126db2acabf321eccbcc26852ffb19c754bbb8f733d135c877c92adf05fc3c3e4efe923ee38ba26cfd25424b53c46e92e6b1381d64ebb77c
  • SSDEEP 12288:wX0pxhV36Di8BtLExdWe2kD3nmXbvtbZGh/C3f+hwGsxNPigJNS2wrk80:tBFKKxYe2WnaFItrhwztlfO
  • TLSH
    T11DF4234837A97109F0FF47B02175A72847B622D910E2DB7D4EE512FB46E7712C32AB4A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecollectiondiscoveryagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1