Extracted

• • Target

    34e8ac3bd8264bf5915c4bdbd7317bd369a1c60548f3bf18ddb12f0780593208.exe

  • Size

    1.1MB

  • MD5

    b9af76d896e7492a84a0d48266ce4608

  • SHA1

    bcf5fcc8b4fc7c0e9460a180bc00069aeb9d0c28

  • SHA256

    34e8ac3bd8264bf5915c4bdbd7317bd369a1c60548f3bf18ddb12f0780593208

  • SHA512

    379643be6d172987fe86e65ac46c814d0cdceebbf906ef5e804669fd5e33ce33a115e233993adefaac4be9adcd3b895da817d52a206867dfed09178351778124

  • SSDEEP

    24576:LRmJkcoQricOIQxiZY1WNy6mpSQLAZrPuujMH:IJZoQrbTFZY1WNy9pfluoH

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2