Extracted

• • Target

    2e238660da100b3dbe74eb6a80fc6d83303b2520d8f232ac35df244aba716f04

  • Size

    1.5MB

  • MD5

    3106a9b3431d49f03d2cbd64688eed69

  • SHA1

    6bae966bb3b983153e7c6944446ca2cbbc29c10a

  • SHA256

    2e238660da100b3dbe74eb6a80fc6d83303b2520d8f232ac35df244aba716f04

  • SHA512

    164e4d66ba668a255f02a3222fc07596962f4a8983195bb4ecae234148ec244c30abeee838bbc5f8db74fb4922b67a872af21dfe8040d35d59eb982f8402aabd

  • SSDEEP

    49152:G5PliuQqKlsxx6kPwXPFZrmK1dHURpoqtda2/:G5PcuQNs36kw/FYK1dURvtday

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2