Extracted

• • Target

    542963e6ef6563af61b1b4b90157c500N.exe

  • Size

    1.9MB

  • MD5

    542963e6ef6563af61b1b4b90157c500

  • SHA1

    99e4cc3ec70c054de7ba0821e5aa249b4c654ffc

  • SHA256

    fe5454fac2eb7f102c766ee44d0deebbf3d5ba0d6e3fc0d8f1b2c6621dfdff77

  • SHA512

    34b70ef476fa70b9fbc7fe9b7a99db763e3e22f364d06bb9cad0667fff357c963deaa8cf40bbb4c573cc2ff48e2ef9c7648ffc41749a073b18515892ef6843dc

  • SSDEEP

    49152:3SJChpoK4czru6sRSnin2+zcRARaKpOB0IGb8sj5ip0jkNG3W+0Sqp:brhUE0fP0n

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2