Extracted

• • Target
    Noua lista de comenzi.exe
  • Size 604KB
  • SHA256 d9672edbb45fefa3ca9a12a91c8d27727f3e5262c76cac9efbf67925d6d6fb78
  • MD5 26dcacbf5c211b0b1bfeeadee42bdb0e
  • SHA1 89f19fbf5779145b4232715594bfc0e321a5d874
  • SHA512 de98fcc7006202283f5c76d643a6d9d902354f130e3b72c2c6c75dbabd1eab0b0bef86aae5618ac6336c774ed4e6b392f93395039ce957c5a8c19984720b188f
  • SSDEEP 12288:oDysSR2IMrE0duRCJlssmXRmA6VmtUobBkBcUoVrW:jMrRsrlIA6VKUobmBcp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2