Extracted

• • Target

    d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8.exe

  • Size

    688KB

  • MD5

    278a25d8b1beac144cd590ae592bf680

  • SHA1

    d4b9110b6410fcb37e99ba258610a5f7d12fcfb5

  • SHA256

    d91d556c48fefc1f1884371fa4277298c37b78d2296a4cf10af7c1f7036f38b8

  • SHA512

    92624e7713d5f58051b4668d969152bc6c56672ea40bd6d797a5097fcade3876b4cf085c25b52dc4ab8ebf39a30aa0284cf44b18993aeec77bd22d0d250bd4ec

  • SSDEEP

    12288:PPGzrfXc/HjdgsKG1E4LxdFqNFimnv04/njlcZdkR:uzXuHpgsKG+4LTSz04/jlT

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2