Extracted

Extracted

• • Target

    PO121220230000.cmd

  • Size

    623KB

  • MD5

    2dff35f881e1b92e782ebe44560c0332

  • SHA1

    fdd04c9a862a8b7de260b9a51fabda987fa8dbbc

  • SHA256

    803e4cc9b03cad379aa66910d00aebd1e8962098f94c60e3247f059d18f97369

  • SHA512

    9bcaea9fdf40caaac383649c3b65811b62521d65049223eca9a1f26c4c6e46666f1c4f10ab6c5726552cd38e9b7ae8a37e71ab980ff9d02148dbdfbca5774dd9

  • SSDEEP

    12288:eJodHzPZhVJOm7/RNBZsCRU3EryD8g1O9AOV98RObR6OdO6D4/bLR24NWse71z:LznVJOo/1Gso8g1O9A4984bR6R6D4JNI

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2