Extracted

• • Target

    xzz.exe

  • Size

    100.0MB

  • MD5

    fc8c06af4f5f9bc5cf9f3eb94ad7503a

  • SHA1

    de76ed01727013819f9ab3e311dab321c2f691e7

  • SHA256

    731c4c81c6b56754610fbabeae9663c0586a5e435f9e12b8225af91be630c3a7

  • SHA512

    c711f589f11c178fa6ff8afe196eb527113e75e36b9ff752dcf8d5447b940d762fdf9d79880d148fa2e4a44a6c78fc94616dffc2fddfeeb3fc5e5b4e9c1f0d10

  • SSDEEP

    24576:D4lavt0LkLL9IMixoEgeaFNNLSh8ZFA/qoMTBu0Mq9MmCS:Wkwkn9IMHeaF2WZ6gA9aPCS

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2