Extracted

• • Target

    003035044445.AWB.PRG.CHO.M20.20231124.003622.20231124.004549.10532.exe

  • Size

    1.0MB

  • MD5

    50fcb0b381ff9bbef33e90561ca1d324

  • SHA1

    eb9d093de06bacc8204058ba9ed7c77f2194560c

  • SHA256

    eb0c9f7ff7106033740df49533023ab8c93304ec66c76496dde0aab528a7472a

  • SHA512

    811dc2da113f2272b4211c558a9d0882743571ff4a3becc2771718e5bc8e15978f1b0efa030e9dd4df2fe77143c96917b62fca552488c13e0b8ad36929f98265

  • SSDEEP

    24576:6yBN2mseCYCHXDm/jvyzRT5Fl2ue8+KkewDyTnUdVXR:6ybsNYCHTm+t1r+QmyTn+VB

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2