Extracted

Extracted

• • Target

    00fc37b52b2aec6ec238e9b895c8c4131392597b6c1dc75fd7bcf75f7f936a37

  • Size

    1.3MB

  • MD5

    9af598c4f0bc134064630a616ba1d6e4

  • SHA1

    dda98eb1584d4586bd9d8c37256010d21e589d64

  • SHA256

    00fc37b52b2aec6ec238e9b895c8c4131392597b6c1dc75fd7bcf75f7f936a37

  • SHA512

    ae8c26a882fa28f974f8dceb76d39b979b95f676137f8b1727dc96a7af25312b2cf03e4cdfdbc46ebc54b84b67bca5cf370fd943c32b7eeea2221328ed132088

  • SSDEEP

    24576:eWpPO48WQ+NFvq/JHe214jb7Hks0+60KiEKZ9/0VtK:RWYHe4b/0+6od/aK

  Score

  10^/10

  agentteslaevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2