Extracted

• • Target

    6526542b1b9dbd2197866e00f8249956461b249b66db08dfa1d13ad24cdaa017

  • Size

    565KB

  • MD5

    1835987d3f0c4c7a954eba2d008bde53

  • SHA1

    885ece809eafdbca847d8ce38e9b48c5f1c2b11c

  • SHA256

    6526542b1b9dbd2197866e00f8249956461b249b66db08dfa1d13ad24cdaa017

  • SHA512

    401fa01363087ef946a4e31fde2bad28d9c391984f663d115b469b01e7ba09481e3ed654b2340cfbe6650d77df27407d86b70729222542f8bc04153d8238582b

  • SSDEEP

    12288:p1sQaueH5qGVWmG3MgvTtFhG6ymbXlulHHQcBMS32Xozj2Kwa:p1QqFz8g7g6ygQt1Bnpnw

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2