Extracted

• • Target

    c73ae38abd2e91c7b4e23478b1b93ddb6acdeb53746a17a5b06fc36148566955.exe

  • Size

    728KB

  • MD5

    6784a76309da51ccbaac5d65886fae41

  • SHA1

    6115d7b87e23afc642770291c1a3baf016fca8b0

  • SHA256

    c73ae38abd2e91c7b4e23478b1b93ddb6acdeb53746a17a5b06fc36148566955

  • SHA512

    01da53fb28ac4f088d15ecfb9f9c673b9078d10bc1eab26524028263a6e288ee88e5d4b25a25e6f3523a1b82da13741a0c21d88ab5f195e5c6f0a420b92d2967

  • SSDEEP

    12288:rdsXlTyeCGNTiK/jmj+pIA9eI7sII+25+TDidHH6o5gPHWy2OW6ZVT:rdsxyqNT8A9/h0CHNZ5

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2