Extracted

• • Target

    yy.bat

  • Size

    1017KB

  • MD5

    4d1fe0a1752f2405de5802aef37be7e4

  • SHA1

    7b0f523763798939b510f29437aec76e8bf7388c

  • SHA256

    db20a7e5e6da87473dfd4a71d6e94bc16b116afcdb33b5da67048c31716a926c

  • SHA512

    c74bafb2e8e00563dd00d8255aaeba271b6b361f1a820c2331e48ee07e7ff578ff00a7ed584635033d430f5986a8c2180c8c9f8ada1a073b6cfcc70d1d168e11

  • SSDEEP

    24576:M102QokUMfJmlfdaedmp+hohWzAlXl/Gju:yUy34WnAXn

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2