Extracted

• • Target
    _507224977a9112b74ca87ea08828259c15d39bd9744d6a71416d5e3500939b01.txt
  • Size 3.2MB
  • SHA256 507224977a9112b74ca87ea08828259c15d39bd9744d6a71416d5e3500939b01
  • MD5 f3e38325c63b650ce064a36519a3f0e3
  • SHA1 74a1caf6d63d508ee0e6faf97bb43347d3b2b511
  • SHA512 df3cdd51a6bcb0853e2fd9464afba5cb25b2354171cb7bd94a1ad427a1d59d8850c3de406be1f0aa0c497d2ac2b9d44a4a91b7b195d8f806b31cc480259fdf5b
  • SSDEEP 98304:eGwLmx/kdoYGl28zrBZo6UOeU5ATRi1wxb+E4dStRUoP:nwLmTYh8zrBZopmAViob+E+NoP
  • TLSH
    T154F5295517A4A1323B21E7AEA537EFB0A40F901318D9CF14362EE318791CD4FA758AE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2