Extracted

• • Target
    _db59ee3698f5ef62b6cebd37f3867bcf0b3db325491a9464164609d2ba0ed8dd.txt
  • Size 3.2MB
  • SHA256 db59ee3698f5ef62b6cebd37f3867bcf0b3db325491a9464164609d2ba0ed8dd
  • MD5 7472c71cbbeb442831643a52988b2abe
  • SHA1 ee6bd303f9b131b3e509a690972879ac32d3fee9
  • SHA512 d05dc552bc1af40767ccd7208763c448b05703af09ba059769549928ea35498a280c13b10de865f64297c147a59de094298a40cee52956cc8cdd896ee5e38651
  • SSDEEP 98304:A6Fk08Rxq6a/w7N4OwyCc/FAjhFJ8/Woa+uRqq3rJFsaOyq40sEML6R93O:A0Mu6ao7N4OM6Af3rJFwyqP4eO
  • TLSH
    T17AF52B404628A4B07A7ED73DE037AF60464E20171198EF2D3579A758B693F5B278E8F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2