Extracted

• • Target
    file.exe
  • Size 614KB
  • SHA256 cb6d360b28e57ec435126f83370bb1cfb4e66e45633a080628bb6d2c3579a558
  • MD5 9a8f42d41f07f1aec216b2be04ccbe32
  • SHA1 d8f584af36a2ffa074b81ef8765dcb0f72ec5434
  • SHA512 5b0cbc5feec5fdb9312b6438df6c7dcc6fc7d3410e640f3161c2ff87c0fd5b025dce85dd8ccebf4a2e4380b230e1ae07457df09bd176f1538c086941b76d43ba
  • SSDEEP 12288:R1mX/lbW9pEABfUnAVTVnW8VcIyicy5YUhxu7hdI5fiz:qX/lS9pEuUEFHG4lUHL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2