Extracted

• • Target

    Documents.exe

  • Size

    1.1MB

  • MD5

    870c75311ace0bfc0493e146683aa461

  • SHA1

    40a14357cf0a5e660f420959b9aa2e39860fe71e

  • SHA256

    4896d44c5a38409245c325f61876345a7ee8d8741905af4c0d2910baa2386dbc

  • SHA512

    d67fd1df37dfe1a23a4ca142a0e9b69e0a0921ed894c67585198f026fcbce1dbf2462d2d453bd33be76e7093fd5752d9f80643761c26453308461e3dae1a0b34

  • SSDEEP

    24576:e+12zVZ97VL7N9Eapjbj6UsgkfE7b4Z1bQkv65:DAR37HPe6GZZ/

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2