Extracted

Extracted

• • Target

    9705fd822dc8a6fddef3a22600810cb124062c38801c3adc3a23514b23455e7f

  • Size

    663KB

  • MD5

    afe860e0fc97eb5a6e4f8ced220d1178

  • SHA1

    b01b2ec28acb0a26624d7d31fdf023a683e6ad75

  • SHA256

    9705fd822dc8a6fddef3a22600810cb124062c38801c3adc3a23514b23455e7f

  • SHA512

    afbbc5cca7918dfc1fcbc0a46d92ca1f7b830f503de8ea45e9f5a13441666e257a497add34ffab84a0740f70e39a2ff220e0f0bfdad3ecc75b43d53d6431aac2

  • SSDEEP

    12288:68keQ5vzi3qHx+WHfqea3hn5OVUKJbi+wFNCvf/EhWefyO2I1B6YepBrrMX:68kri3ux+Iqn3hzK8+wG3saHIv6YSv

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2