Extracted

• • Target

    f45d13987da07c44c15886a61b0534254e8dfc55b9dca16156df5e2a21bfc5fd

  • Size

    931KB

  • MD5

    865453d35978362a078b83a0d81fd4d7

  • SHA1

    4ca31c90c511e6deca6a003f017f0aac68cea1d3

  • SHA256

    f45d13987da07c44c15886a61b0534254e8dfc55b9dca16156df5e2a21bfc5fd

  • SHA512

    4e83f4b5ee9d8515c403468fe9dd8541cb1d035a2a98ff538f92eb944d2086f760ce7dcc50268f432e71cafbdc7c4668a323d42e5d297f92f11e2d89fab17815

  • SSDEEP

    24576:kz8P0OEsxo86h6ZAx1GSlnNHL8JG67YDtzH:1P04o86h6UsuxLIVEtzH

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2