Extracted

• • Target

    c40c36978fc01bcbd7eca78bb7b5689b7460bbe7ef122cc2a2cde6fc415d24e0.exe

  • Size

    1.0MB

  • MD5

    cf702544b48bbe770375eb7188464eb8

  • SHA1

    d19daad1628bccb94b5e5cbea08310231def8d99

  • SHA256

    c40c36978fc01bcbd7eca78bb7b5689b7460bbe7ef122cc2a2cde6fc415d24e0

  • SHA512

    0461297a310f67479c6d9195c25ea4559728b7ac78d3120dc689511373880a2800cef45b960b7d4b5fd23b87c0254ef7e139197d12e0af55b6b07759c9822192

  • SSDEEP

    24576:Q4lavt0LkLL9IMixoEgeadFnfJgV3q9MmCS:Hkwkn9IMHeadpRgpaPCS

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2