Extracted

• • Target

    1c8411d0dd544bd74eb6994ad731065f05d55e00e4046d29f9f9a9abde5db672

  • Size

    790KB

  • MD5

    2215e1fdd4293fbc68592f04c85d55ef

  • SHA1

    b4861fdb38c1fb3e55bc21cf97a885d174c02833

  • SHA256

    1c8411d0dd544bd74eb6994ad731065f05d55e00e4046d29f9f9a9abde5db672

  • SHA512

    79f63c59a3e0990c3601f99260120b70cea0a180807fb6a9cd3e454d086d13e14f9d7cc53b81f0642bb6c2d5e710f74eb44c584ff6945d87764e2902a5da1324

  • SSDEEP

    12288:jG4hkZ5ppiBvrwQPumRo0+wVOhRKdGb6MDaNuC4nmewzgFND1AW6CIwpDp1rDsl:jpK/Yr3PumTBdBNmmWFNDzrpDp1

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2