Extracted

• • Target

    db31771b423567e0dad13e11ec3ab7eaa2c1ffc4d7c0adad61df5366582e01f0

  • Size

    251KB

  • MD5

    663302eb9943f93b672d0b4bda82d483

  • SHA1

    93554cdeb1362f193ff3d96ffa6691f2941bbc90

  • SHA256

    db31771b423567e0dad13e11ec3ab7eaa2c1ffc4d7c0adad61df5366582e01f0

  • SHA512

    2e968ff87dc9c64b920dbf5fd0063b998dbf3827c0b306f6e918caa33c4ce46ac20b70d821d54a64d9a69c8df4ded7119f986ad2f583bc83bab91b22fa5b22fc

  • SSDEEP

    6144:l2Z+RwPONXoRjDhIcp0fDlavx+W26nA/0mGZmo7ky:

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2