Extracted

• • Target

    49ff5dbdea22cd2a12ab7b158e217719b01989042c824525175815f10df22d60

  • Size

    165KB

  • MD5

    478a7584704a758ee301ede0d052f89d

  • SHA1

    cd7ddf88214290d758d6347232e4f7fdc0e8156f

  • SHA256

    49ff5dbdea22cd2a12ab7b158e217719b01989042c824525175815f10df22d60

  • SHA512

    fd327cab1d30c088987b8833e8e961ebef40856ba38b61c522954fa1e72edb503b5a7edc1caa958519f707609d69f232cd80654321663b08cd79a84546f65282

  • SSDEEP

    3072:xHQV8e98bPvlyVKl2BXIWnUbRS0V6UO6WTvUxQ+weX:xHQV8Y8rUVS2BUbRS0VLqAxQg

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2