Extracted

• • Target

    e75baeba1dbbfe5b5d9cb8b865aa504329ec50c4df9ba56fb0dcb03278f9a3b0.exe

  • Size

    2.4MB

  • MD5

    68676f1fc74ca8f74a4822c9c0042eaf

  • SHA1

    0d7aa8fbbcf7a7babf7bddf3d4bac19884a1370e

  • SHA256

    e75baeba1dbbfe5b5d9cb8b865aa504329ec50c4df9ba56fb0dcb03278f9a3b0

  • SHA512

    cafa516c55d669e7bf37e52bd60fe53fe687defd5615a87480c7e2644569bce5039a20b41f2d1370ba2a02cfd95bf12dad6459209d0348049ed865b9c7a253d5

  • SSDEEP

    49152:l3AQbdYAm4zEbdYAm4zWbdYAm4z23Aw3AWbdYAm4zSbdYAm4zO3AWypvLe6mTPLc:hAadrWdr0drkAiA0dr4dr8AJTmbI

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2