Extracted

• • Target

    f6a159ce38c4f10ffc73685f38ae02e7.exe

  • Size

    590KB

  • MD5

    f6a159ce38c4f10ffc73685f38ae02e7

  • SHA1

    af71f633197d8e560fdf10366e1257f3e7cbf174

  • SHA256

    aaf8ed048165e8451ba35bbc87acb547a6ac54263de44f85137ff07470a2ff22

  • SHA512

    60e400e399ea6d6cf314a18475660fdad846a33cbb0e24aa4278b0f09d032d4cb821f8e9207f238ddaa15dc92997f078983d86478488eae57c2eb77ecc4acc50

  • SSDEEP

    12288:2x3g0pUof7IMwM8Qzw5lEZXa6iM9SABfUnmvfMy/tlCeN5i2iNLAZ98vcGgf3Z7Q:V6iM9SuUmvfMgjN82QsZ9hZflpm

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2