Extracted

• • Target

    e57cec2b7f54b405b1618129b9328fb7b6ec4dfd4a62c9dc90f8eb3c7d83b898.exe

  • Size

    1.1MB

  • MD5

    21ff4cd902c6695abca7f6bfaa605ce3

  • SHA1

    f82fc492fee45356d0ccf32d6b3e262e20ef54c3

  • SHA256

    e57cec2b7f54b405b1618129b9328fb7b6ec4dfd4a62c9dc90f8eb3c7d83b898

  • SHA512

    a69c690f1f8fe4eb376df749ac903645a8da401a3475de9942b2b9dbea93ae34831b3db1572f2a15e10b13ec66abc624114a32f67f0f210792db7a937897627a

  • SSDEEP

    24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8aJgVVWbyzEyY:VTvC/MTQYxsWR7aJ92

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2