Extracted

• • Target

    804152064.exe

  • Size

    723KB

  • MD5

    331bc06d67e4078e0779a9a0a5d355b5

  • SHA1

    475924a69dee5e4a4ab1a66c944068fa2111db68

  • SHA256

    ad641230d3be8895193642d333ed88e1d6e94c209dfcb6c1932cd6a7f324a82f

  • SHA512

    8e30912ab46b825292955ad70f816a8a12171692272af563181630a4ec0e24de2dbb240c8cfbf666e6233fc9c58858d88de53164dde82a804066c842501c8fee

  • SSDEEP

    12288:sk+J/M+Jhewx/NscEQ+vgXK1HsaPbntTjlFhush1nPTs8HlaxYvR1toDvll2Hvk/:sl/thewlqB6pGjlfusbrs8UYvREblivu

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2