Extracted

• • Target

    1f9d1b268f67bc64c145ba149a9b0ecbce8e08d3d8149732b77022278089f97d

  • Size

    819KB

  • MD5

    3e228a5e2511f4337cb453da1f7aa029

  • SHA1

    8f15b8016c6c11f01d5e256561d9a95807800195

  • SHA256

    1f9d1b268f67bc64c145ba149a9b0ecbce8e08d3d8149732b77022278089f97d

  • SHA512

    dffad996d3be928b344e89558e9ebde9406cbfbe77cc6e4d4fcc232e7e92a08dad83f86b9280efdb914e8482ef1adfa83fe38630859d0a995ae2a935e81fdfb5

  • SSDEEP

    12288:UsFbsfI8Z1gMFVobi/WS/DTOTH1D/4OP5s1C7H06uwx1Rfv2Nl58PXOdOgd:U0bsfI6dFqbI7s1DrP5q6uwlnG3

  Score

  10^/10

  agentteslaevasionkeyloggerpersistencespywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2