Extracted

• • Target

    79852db3ea78ca8c3b3cadef3c3283f4c598314fb10c4cc065077d9f02ce3f4a.exe

  • Size

    614KB

  • MD5

    9324352f26da8d7bcd72f9a1bebaa7e8

  • SHA1

    0752607537b4b2c5a2fbe541c7f7488cd16315a0

  • SHA256

    79852db3ea78ca8c3b3cadef3c3283f4c598314fb10c4cc065077d9f02ce3f4a

  • SHA512

    9dba58005056fb0ca0095b206c20e2304a9d0eb5368f7e10132f0c080b66a670f4ffd85632888c896f1a99d333a0c0aec236f972352255ee11abc940b4ef25fc

  • SSDEEP

    12288:iqfLYYZXTyxFDX4YVtdJHmkiFsAZccoRXztqJZWVujBcbKNWZc:RXTKFDZVtnOFn03i+ujjNQ

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2