Extracted

• • Target

    Request form.docs.exe

  • Size

    745KB

  • MD5

    44cb7649374df879012160b24ca69a60

  • SHA1

    c637e480a3335a8ade7a28058798e6ddc764ca89

  • SHA256

    3033730f6b585fdcb6e1cf2a88e8debd2f73e2e5c7064ec0b13e471bcffe191c

  • SHA512

    30add6247c2c9b4d0564f7433a65541e6d8e4c5d933bf655ab3ac1ed4cf6047cbff18cfc6c60b2d4b7c7f1810802e93a851212cdf1d694e2f897de0ae1536f6d

  • SSDEEP

    12288:os1XVFrB0mdEATN6P5zK3vBdljH8aEQalJacLyJQE8cWwz3ZsqJ/:oAuOTNmcvpjcLQyJvGGErsqJ/

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2