Extracted

• • Target

    c552b8ecaf95f50de9d1bd6e73bd241227d202b483cc6f9179d9a9b88ad796a1

  • Size

    46KB

  • MD5

    e6a54ac9fc726f9e97bf504300cce3b2

  • SHA1

    735ef8962bd6a9e4f45d7b9e03d6b5066923bfd5

  • SHA256

    c552b8ecaf95f50de9d1bd6e73bd241227d202b483cc6f9179d9a9b88ad796a1

  • SHA512

    ca5ac209f710e7a7d9fbf2d32258548afe757b149869d68257bd4fda6499c78c9174e4763991f1b6c27846038a6c286b3f465643b57bf8e1bfb19a7f48a24f5a

  • SSDEEP

    768:ebFP85m9v/hW+i20vMu/eDFxm5a2pc1SdwBLObtNGF58b60sADZEpYinAMxK6dQ:eRP8ka+BuCxiaY/SB4LGH06gi7HxLdQ

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2