Extracted

• • Target

    20429c55a73afdab0975bb4aeac8d61bec3431479a91587850745adc350979d2.exe

  • Size

    1.1MB

  • MD5

    f4d1eb5df87d3c4367610ea748e3328f

  • SHA1

    cca9813afa027669b352d9efa864cb3689580383

  • SHA256

    20429c55a73afdab0975bb4aeac8d61bec3431479a91587850745adc350979d2

  • SHA512

    9c36c6aa7f6f18df97ecf0acc2708d96268c54437c8d5411e5a429e5977a4e328f9a0b4c1a4ee7fa8818337d8af5162b06d7d3972207328f06247f094736a91f

  • SSDEEP

    24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8aFoauhP3:FTvC/MTQYxsWR7aFVuhP

  Score

  10^/10

  agentteslaaspackv2collectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2