Extracted

Extracted

• • Target

    ce8a09bfc9465a67a90006ec29217a8462a915e548b60201343fc17ea5f137d4

  • Size

    687KB

  • MD5

    9777f0be43bd26b1410add70663870b6

  • SHA1

    964b416a5a44710c28dd13f9a1b5cca50a8f692f

  • SHA256

    ce8a09bfc9465a67a90006ec29217a8462a915e548b60201343fc17ea5f137d4

  • SHA512

    1460c4cdd9332a4d761df12aacb3e948cf2b69c362201fd8c931289f821d82558a7f69b460845cd302f4cbdb828894d4f8b6ef2ffe7f3f4f7f54418ea539bfec

  • SSDEEP

    12288:DqSgC74CMwLuC2Lhilx/4BIYkgX1xn8kQL/Ff8S7PyNT/+dXykHC:DqSFN2Lhgx/4fkgFxn3QbFf8S7dXL

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2