Extracted

Extracted

• • Target

    5bc44b5cce3e2fdab732e8edb9abb27c36f5eac50d191575c71d4d36a48ed5e2

  • Size

    340KB

  • MD5

    0464038233718e1c25d74a89e030907f

  • SHA1

    216e1c68b9894f7854a071d1762874b0861d002e

  • SHA256

    5bc44b5cce3e2fdab732e8edb9abb27c36f5eac50d191575c71d4d36a48ed5e2

  • SHA512

    5aed413c1177714135a58c7490e6908603c10b244c6a6dc35326d1efdac53c02119871e68c3e562cffac81e2aa1ebb4c63db436c5e73707d7047a94e66855a04

  • SSDEEP

    6144:/eIxlsIv+RwxD0Hws+XPbX0i6ydnT2ehOrbMd2AG930Ma:/eIrpxD0HYPP6YKHromB

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2