Extracted

Extracted

• • Target

    09a7a280c61a8ddaf1912258ec251f74ee5b500d646060fcb0f773f0f699ce35

  • Size

    480KB

  • MD5

    2b2852033462c4df5962712ef9df065a

  • SHA1

    06a386b10e3806092a73f8f60503c1c5483ac9c7

  • SHA256

    09a7a280c61a8ddaf1912258ec251f74ee5b500d646060fcb0f773f0f699ce35

  • SHA512

    8254cc3babb465e138bcb1640ec097aebfd8fa7cea5b500e8b87c472322323f7ebe3e9cdbfac421c51be606969329e98b9184c738f7baa030673e2c16e2c94de

  • SSDEEP

    6144:CScA9s0fk2yYbeyBk8oLOARm4KTjKmu/byFIMVIHlI5WJ6sNX4/7yhc59lMiuMP3:XE/kIFI5WK7ye59LuMPL4ljwAMDNL

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2