Extracted

• • Target
    Ref77013962020.exe
  • Size 1.1MB
  • SHA256 c5045c31e194bd94e8979a7a8d46f5d403d98e697cd7f9335c5ab0904b613fa3
  • MD5 2ad81b515de54e3466eb1148cb61930d
  • SHA1 6aec98a97e93f5b77df047761167b90e412f753c
  • SHA512 2b7b873d26de0e800190d7a8c8653ca1eae3f76095aba23aea3b699671cbee4264251601ad566e1f7e2793bd19570c188eac807a0251ea7ddb44fc53c8fef9fd
  • SSDEEP 24576:XAOcZ9OnxbjC2Dp5VSRVhz5eBq2MNxjFJ7oHeWXL7Wf1:pVhC2vazz5nx9+7Wf1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2