Extracted

• • Target

    2b8f5dfdd98be0d5612f31c49ec4e3abdc14ab16091582f904949a1bdf476ab4.exe

  • Size

    1004KB

  • MD5

    4e7bb29d166048cc7cfc1da9ea7724b2

  • SHA1

    9eb9c47af2903cc89fc01ad170b45128b0a82748

  • SHA256

    2b8f5dfdd98be0d5612f31c49ec4e3abdc14ab16091582f904949a1bdf476ab4

  • SHA512

    215001c482742baffa805ab3c6d8b3315ce9dbd3704f8502241ef9716a94d81c907dbb0697c9cbba1812496c96d7a1b3304083f9088f1753727af0a2d7fe76b5

  • SSDEEP

    24576:cAHnh+eWsN3skA4RV1Hom2KXMmHaz7Bws1IF5:7h+ZkldoPK8Yazb1i

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2