Extracted

• • Target
    _600ecf66aee0d3e87602f212e4c4d4b676342005d90c54bc25def50b1243205e.txt
  • Size 317KB
  • SHA256 600ecf66aee0d3e87602f212e4c4d4b676342005d90c54bc25def50b1243205e
  • MD5 15f5849792cb37ba7191b3f98d714e8a
  • SHA1 dc1628df3444de85acd7cd05b3b2f631dad4f301
  • SHA512 9df4c9760b6622881a8c96383bb0610e4586ded44147001744aba0dd6a9ef4393706140e5ef957160c9c2a04d3245aceab62ce28540c381da6a21432f0f07dcb
  • SSDEEP 6144:9Sdgu5IKWpL2rKD+Qae7Aee4hIxCmki41slm7C8686BYRR7PLRaUftHe6H:25IKWycmeKu1s0t7TRaK
  • TLSH
    T12B645B20ED24067A0F471799FDAA0B61CABDC219863654F5F6DA030D610A5FCE3FE369
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecollectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2