Extracted

• • Target
    b39ec4e8104e06705f1eea981c75ebce.exe
  • Size 351KB
  • SHA256 80ae62b5d4012d415c4cb598140cfb6ad485b07f712a0c40d31d6fb46c4dd922
  • MD5 b39ec4e8104e06705f1eea981c75ebce
  • SHA1 7be155468ed14d5e7a8dc4b148ae3f85525417eb
  • SHA512 313816e5804c896c5667d79b1932c9acfeceb11ec57df720acf5e565810d376c6e0a4170893567842c981a862616ec1405f141bcdb6d6c724da07c0959df1088
  • SSDEEP 6144:RlUtnJcqhzaSI0jd9oUphk48ln0ydrwxuFF7CqdEyr4J0HioEjDcuqoAY:Rl+zaSIUd9BpcR0ydrAixLY/n3cuqo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2