Extracted

• • Target

    MVALIADOSREQ1900064.exe

  • Size

    1.1MB

  • MD5

    d0cad8abc1084efccf82cbe747104c3f

  • SHA1

    fb30f4cb31782c78d24b55071c618070b84c4b4e

  • SHA256

    a17cae5463618c9758dd98802353f8172e343dcad936a44c5f1d1fe5ff7813f6

  • SHA512

    1633f369d0a94f7000403ff7762087923b34fd3292fc27ed3f153aa590fdb29e92eb2429890c9b959625ee7c8e328d95886802225492b1c6e1849e04cceb9eeb

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCamxvrmQbae7IkAKZt62:7JZoQrbTFZY1iaCamFiQJ7wK

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2