Extracted

• • Target

    USD$46,860.00 All payments.exe.bin

  • Size

    638KB

  • MD5

    c3f5d351824706c4a655c3759ab10afe

  • SHA1

    8d72cc01c11767e3a7bbf711d4c958870114b215

  • SHA256

    5c98f2049c63db553be8fa363503970a5dddc57966148d123c6b12ca17dc9838

  • SHA512

    f869cefbed645ff12e09dd2c4655f11dedc0710c1e452dbd2a83bdda44567865ac0ea2ee76f42d4151b76ca71e83806835b118455fdfa8c4c61767d602a29b3c

  • SSDEEP

    12288:unlrEdwemEo8V5VnqU58iN82RCAP1L59rrCoh9zcL7ql1hYsSj:QlbiV5hP5HNhl1vCGC7Qb

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2