Extracted

• • Target

    Número de pedido 4200184273.exe

  • Size

    1.1MB

  • MD5

    b16013adb22dc5bfbf451f39eb236c3a

  • SHA1

    a631bec8b7c0b9cc7e15650696cfe2008e831293

  • SHA256

    b1d0a89c8011e4cc83a8f5a85de92655fd7515bb816a15959505ce3c2c897871

  • SHA512

    9e80d52969ebeeaa46860095d27ea76b7c1e04f9d21cbfb043fc91ba2f988e50fbe61c837ad18c6982d98176f226e6c700e8da9bdc1145ca5336a8e8ccbc4c13

  • SSDEEP

    24576:fqDEvCTbMWu7rQYlBQcBiT6rprG8akTXQu21men:fTvC/MTQYxsWR7aKXQuMme

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2