Extracted

• • Target

    Comprobante_swift_9767864574756346523cc43546576ds8977564534253465789.7z

  • Size

    791KB

  • MD5

    eefe9cb1da2c5dc85184e4f47e5550bb

  • SHA1

    062563762fa1051449405812ae257dddb4c6694c

  • SHA256

    e446ae2fc3adac5f36700dc6c69efb421a569266cae84742e7027d6c980a0f6e

  • SHA512

    f085850f6402b957a7f048284131d7e4f3e696d5b6b4b4609bea1d93f61805af0451dc942fb24ee585b3e892c906284e13d5a95fc6097cb4253c2669f9bc3a44

  • SSDEEP

    12288:XpUqUQJx5t42kZqfYt6J5EquI6jDsjPeJA7hJDwN0Brp/Uga6ZRxzZ6ls6Gbpj:ZpUe5ePqfBjJj/hXZ9Uga6RxsGbpj

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2