Extracted

• • Target

    Balance payment.exe

  • Size

    1.2MB

  • MD5

    2a9d09fc65e58d1589d0d10eb43c094a

  • SHA1

    411e29bdd4bf197ad7a44d4c675e0c0dd78538dd

  • SHA256

    0fc79caa00d59d4864ef9d4218cf238e52ae8208906c8e4d0a5d8e81c3607eb4

  • SHA512

    b67e6fb8a2a8d521ba395b8596c2d46212e631d1e04ccc0e67a0a50d6bd42943d1ff2b1aa9a4f317a1cc4fadfa930c80c4b88f97d484cd5ef0b6d3b82a4bd820

  • SSDEEP

    24576:YB6iYOAM4OF+PMwrSVlbmfDYkhDvGtjXtGUAF9kJ7MqudghfEuCj0hThiHHxlhV0:YBDMw8LrMx

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2