Extracted

• • Target

    70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817

  • Size

    192KB

  • MD5

    c83e8d01fa4bb2a29de8757bab77c261

  • SHA1

    fd996e799182968527ae6bbae5949f6970e41940

  • SHA256

    70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817

  • SHA512

    be57ca047c5d909c7d792ef4c21936988da5f5a0667f7c5d89cdfa31f34579fd3dafb04f0a0d4054b7202cfdc4a8671157e31749c20276d0e40896f9b135186a

  • SSDEEP

    3072:vgjT7lyimAFECy61CVJ1o+AeBImCytphGqsdo6pBA:vgH7lyim7CED5AeOdyqdo6p

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2