Extracted

• • Target

    81bd5aa262413bbd33634493f9df78ef8293fc704adb1a7bf121f31b6b939cb9.exe

  • Size

    1014KB

  • MD5

    2e104c0bf13525c4f527f1e95bf18699

  • SHA1

    6b9827d8313d1840465dc6403e0975e688e3b3df

  • SHA256

    81bd5aa262413bbd33634493f9df78ef8293fc704adb1a7bf121f31b6b939cb9

  • SHA512

    3963d8e1a175160930ef62b04bec14b5e3e0d1cb0f4d6c58eae79d74b9d3393f72bf5456dfa763698a9794e6728b34a5b7ad09a33cef2d4c87bc26d109864557

  • SSDEEP

    24576:MAHnh+eWsN3skA4RV1Hom2KXMmHaUiiY0BJqS1j5:rh+ZkldoPK8YaUq03

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2