Extracted

• • Target
    Purchas Items.exe
  • Size 598KB
  • SHA256 942181835b4ba27f416333219bfc5b78aa793be8d05edb5c6a4c78a60e00a7f9
  • MD5 519db082038048a6bf01e80db413290f
  • SHA1 fadb77997461ad629564dac8877a7608cb349937
  • SHA512 1200f8d9b9ca0798d2e11816acc69df1e1206529270633f80f805f54a680b57eed90e0ce9486aa0ba8e21c271fa24da68b4c997b3f3f108d9117b4100e5bf75b
  • SSDEEP 6144:Q/t42ZcaUbrayUebGEITZDtI20Tm0zeGP/IuTa9YIdwV9ne5jIab9WKQkIPOTnnS:SvcdbrUebGPzZ0TOSNSSV2sAQjOTnnp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2