Extracted

• • Target

    9bd2872c21699d60de7830ceeaa37d2f69dd8039a089106abd91c1a7dc1f8e96

  • Size

    708KB

  • MD5

    f962699073f9c99e8da4d33ef39fcb77

  • SHA1

    af40a09acff0e81c61f2834e7ed7f56a9ab926b5

  • SHA256

    9bd2872c21699d60de7830ceeaa37d2f69dd8039a089106abd91c1a7dc1f8e96

  • SHA512

    c7e9cc304b5cdfc15c4dd563e36f5078fb83255682f38ec7ad7aa1015cdbd2e9569dcde370fa731361315f5139394a0cc70a770e5583b686c7659571325a73be

  • SSDEEP

    12288:HDK4A9be9pXLOo1/SYJMGhEw/XlC8TqUDVlHeSSlo/uwk/9S5zb:jKmh9AqhEw/Xl5uUDbH6luE9

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2