Extracted

• • Target

    99677c9af723d0773f67fe035205dbbd9d857022b1619fc33fd83808072d2caa

  • Size

    542KB

  • MD5

    055e5476942818329e232d273578a1c3

  • SHA1

    dd1b9aa4a8b359f8e88b0562e642f76294b579d1

  • SHA256

    99677c9af723d0773f67fe035205dbbd9d857022b1619fc33fd83808072d2caa

  • SHA512

    6c877468562c7527a67433f0b9a41cfd343c6ab0727a17ad238af512b867dca486b46c8ebb7b8cd6367bfbb5f1997d30e4ea99492686691778f9792d66cc4734

  • SSDEEP

    12288:2Pz7kFLaghtSwkVaN9ozd5YA1XCQJet5Uep:ua2+Sr4M4CX1JmUK

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2