Extracted

• • Target

    3d13d0e84851ecff819ac29d35c7e0dc570d7a1e7c768f10f19c4fc09997231d

  • Size

    746KB

  • MD5

    8aa87c125f30b524ba29298daee882f7

  • SHA1

    72e10d34c3c9bf2b1055e6d1a2d9f434f30db9c8

  • SHA256

    3d13d0e84851ecff819ac29d35c7e0dc570d7a1e7c768f10f19c4fc09997231d

  • SHA512

    70f12ba743212a0824734f9d982e51267078090711ef6bc4adb131ba1486501350c4f66ba2f7300ce7630c778d222f625f900f4a0dcec0658a6d2bb2af2c1de1

  • SSDEEP

    12288:qtLyiHrD9N5VCLQnDxAn0MadZtTNOFCngU7i3ZKHhvWU:qtTrDRA0MarOqgqipKHh+U

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2