Extracted

• • Target

    b86c811ee7f0f3e6c8d3d1e8a9b431f19232b6abae2bc0c85ebcc03857f1bb68

  • Size

    12KB

  • MD5

    d9b2665773e1e3dfc4c6a0e16e64ef52

  • SHA1

    303b98a5296aa57fe9e6a4506eb44f15df20924f

  • SHA256

    b86c811ee7f0f3e6c8d3d1e8a9b431f19232b6abae2bc0c85ebcc03857f1bb68

  • SHA512

    c5ad6fc09b15b2ca8e009a6f937b503c540d368e7e50a19da7172b89d2958c2ab92c7a313ce1c4da3d421cee298cfdb8863ea7e3d3ad3aac5339fa138413ebf8

  • SSDEEP

    192:XfPLlLSclLMEYjJ1DRulL9q4PekyRbdXFTKWEBbOy2xOdV/0xewPwz:XfPLlLblLMEYjBsL9hcdXWf2P

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2