Extracted

• • Target
    _ef013d902ac3621b21285d8a9cfd2239baddc5f1f4c5fe6b2f06e30ff3cfc0a0.txt
  • Size 796KB
  • SHA256 ef013d902ac3621b21285d8a9cfd2239baddc5f1f4c5fe6b2f06e30ff3cfc0a0
  • MD5 bc1f2013de8247f8766fc9e760e9acca
  • SHA1 c925cbecb4c96ad7ff0972dbf8fd2b718d34b6f2
  • SHA512 cf2dd691a26bfba07412edbb442969812c680b4a0305f1fc5e5750563f86d25d8cd1dc9c3fbf8e236d11eaf5672c92a294865ef996895ddd2b9b9ea24591eefb
  • SSDEEP 3072:yBzCU4cUK6mMHjHhAEmTEkZnBSvkToUEtUEzsj8l0HflVr+zwx3aCHfO6XpixKJW:fyXK
  • TLSH
    T11B05D83DC959422ED172D728C49E085FF8822A0B563CD84B65CA375F6F639427BC236D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectionexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2