Extracted

• • Target

    e7f46dc7145e87eb0674a7b2b7b980a886defb6e8ad7a2caff796a3787a01dff

  • Size

    422KB

  • MD5

    a4b7d954a47d10725218d26512544394

  • SHA1

    4d7a7b92c256927cb93d78896f278e8945ea0665

  • SHA256

    e7f46dc7145e87eb0674a7b2b7b980a886defb6e8ad7a2caff796a3787a01dff

  • SHA512

    ee7554af28b119016d04e1f3e6eae2296c9406e02835f6506bb255c4f606b3cde1ad655217a13d5d51796502047ec590179bb2a45db0433ffce437653a8ae977

  • SSDEEP

    6144:Rxu7VAd87ZC/xmqXAtz9TqawD0vcOCbjcqmBuXUmiedMKhB2j9YDxTgCrC:Rxu7lZ4xmqg9TJtTCbjpmBR3MMluxTg

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2