Extracted

• • Target

    6485c53b3856bc435502490d0337c2bb.exe

  • Size

    1.4MB

  • MD5

    6485c53b3856bc435502490d0337c2bb

  • SHA1

    eb9369983e8b4579f9219e2882b955d36f55a653

  • SHA256

    1ecb491558de8c62b18aaa99230be6620a9ebe3fb7f3ea938a82fa05bcf110f9

  • SHA512

    1306c2dd664c8d729df43c587201d083f6ada6c2d3c56e35187129ec64fad5230e5338ee674515794faabba240c8f143d4974bd0962254552c72b782d77fb1d1

  • SSDEEP

    12288:ddOw3d/KnMP2hWiv4L2jH9nlSNfUu4OJetOSNK:DT3RKnMPqbgLs6fgcSNK

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2