Extracted

• • Target

    5c55eec6f12aa60ac02540ebb2af7b7780d148d76a07ad27bfad0d4f3bc1a067.exe

  • Size

    696KB

  • MD5

    2fad9d22d71aa2c94ee5b6ef0287440e

  • SHA1

    80331853c5503522e775aa7ef10317a14595158d

  • SHA256

    5c55eec6f12aa60ac02540ebb2af7b7780d148d76a07ad27bfad0d4f3bc1a067

  • SHA512

    a7ecba4cab6e47483d55141e7fc2e138915a4425fa86fb15a5034d530ff2a53e1f3785a38c99dfd62b3ead850ab25ff82d5e0699925d26ddfb0b124d191109b6

  • SSDEEP

    12288:XFmDIzln4wgNAqcDZ2ITVh4LhIMA4PDT3XWGl3VlVT6QdtaTlW:1mDId4wqANDI8S3f3BBVRtaT

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2