Extracted

• • Target

    a990796f65eb709905c0f6499e3b3e64220c5bb9792db744d9c22bddbb603e87

  • Size

    660KB

  • MD5

    860f88b68917d3a5f57297cc22a12129

  • SHA1

    fb3315bb96fe758eb648cc31cd938e80f73afe49

  • SHA256

    a990796f65eb709905c0f6499e3b3e64220c5bb9792db744d9c22bddbb603e87

  • SHA512

    9d8b62094c0d594009fabe5bfba60e68b16ebf13bda69cf96136054eb17dbd527cc6f11c61e4a8e061f42b60be78d143adc243e38c8dc9f1c9e01324b7c197cf

  • SSDEEP

    12288:/UF9WMwo8A2HtW8PI4sCBOOuKT+Cv8mU/eM2TCd8xD4/oNIJlDTrS3v/4:/U2MD8dHjI4tBOOuk+oA/eL+S3Ale3vw

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2