Extracted

Extracted

• • Target

    9a40bb86b69f6c6702f4cef6b9b4c51c68d5923a239eaf6ed3029374d13ccee8

  • Size

    937KB

  • MD5

    4a323d354ce4f623d28481674820af27

  • SHA1

    47c96244f4f6c5ba61b09d97694afbf16707cff8

  • SHA256

    9a40bb86b69f6c6702f4cef6b9b4c51c68d5923a239eaf6ed3029374d13ccee8

  • SHA512

    2f5cec2c419460af012bfc233222db3ba7ba64c2339ac4c2f6dca17377c7cdf4f0cfa4fbec47577f35fcbeee728724483d5e98357681261a9a7cb7675a89fcb3

  • SSDEEP

    12288:PMMbni72U8L4042zQ1WVeXFfJoPQ59ouW1md0PaLAJRCIYpu5ssoxJzNJbH7o:kMbni723L73/gXFxoYzcBVeNN7o

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2