Extracted

• • Target

    83c261ea71476210fa5f69e1e306a0ed.exe

  • Size

    706KB

  • MD5

    83c261ea71476210fa5f69e1e306a0ed

  • SHA1

    57e3b8222a66615cc211555f8cdc1b95fc4964ce

  • SHA256

    c1b9ddd584078ecf7375239eecc419c3ebcf441c71db62b8e559b88613861026

  • SHA512

    cf36d08381582e2ce6c80be7f36ec9e5f84cfd5b99db4058a2089add30584cfc0c4ede27071f7e994d2742ed513cd8a1705a88d573c3cae8f82f2b6f31710525

  • SSDEEP

    12288:YG9/FJMVTEkYR5wpZp+E4auuWw1hWeh3ih9HlA:YI/Fq8zQWELWwBYTu

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2