Extracted

• • Target
    Invoice 38129337.exe
  • Size 801KB
  • SHA256 dcd2a1a571f36c2739e2c358225fb7bfa4c8ff7379755aedcc68e1cbd71bc076
  • MD5 7bcb765eb24e99c14ac625934e2a3283
  • SHA1 9f880a683b12a76b3c813392c3dd6f21441a8fd5
  • SHA512 1c1b288bdf01fad14952cccd4473f93f07e9031ef699fef53427e02f6267bd32f5d78ef599b1e4e63fe47cf44f557d1ece5f98ef1f60dd4a6e7531760810d605
  • SSDEEP 12288:/x+OSUAh3NVa42iNa7xdvo/MdyrhFgtDsuBHsSj5J4+saBGENcq8wcwdQpcJvvi2:I1U9BqmycgiH75Bjcq8wJit6xfhJHqT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2