Extracted

• • Target

    z77DHLS_O_A.exe

  • Size

    570KB

  • MD5

    07443e56683f4eab925bf265f7157e30

  • SHA1

    6be1631fee0bd26f19b8dfb9e2478a8aa80c6a09

  • SHA256

    ecade566a9d6d611fe4ee178d686516aad0c5b0af39d07b8e4d9e7900bb3aec8

  • SHA512

    d0020466d68bc87cd2790437d7dab6bef629ee98cc4d236f248f854402927a6aa84c3fbba0cb772904a5e343d46f7903c09a38e2c88e7c08a78ae6e81c920112

  • SSDEEP

    12288:T6Nl1vjJGGna1v2TKWxjZVYR6jVItpnCDtRe2D3oY/G6K7Dl:eNl1LJ1na1v2TKWxjfI3YG0oN6K7Dl

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2