Extracted

• • Target

    f2b1dd5d709a7e606002f1b2a0cda30e07d1635b

  • Size

    818KB

  • MD5

    056dbac271b4b97fac9016695f03be29

  • SHA1

    f2b1dd5d709a7e606002f1b2a0cda30e07d1635b

  • SHA256

    a67119e6131f2cf27b28044e3562d04abd86b62bcebbfa8ed7f4ecea90682f2d

  • SHA512

    6e9c26661573d89ec52e37e1c300bad30d215ffdddaddc8e1b357449c241f19e1dd19a44f14dff4d6c829efd8beeb165a03c4bcda0d853d981839ae84e727dbd

  • SSDEEP

    24576:keSqG4yPa46F0xM64kLOBLHK4FUgmaFq:ztWiFkLOBLHK4FUgm

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2