Extracted

• • Target

    d502defbe8e4d9b6a6ca0a29a28a0da6c4c30352

  • Size

    37KB

  • MD5

    259c465decc19ee0127d9d66e732cfba

  • SHA1

    d502defbe8e4d9b6a6ca0a29a28a0da6c4c30352

  • SHA256

    f220e9f588cb2724058ad0601c449f612f9355243aaa2fd7ee1d87fd177cdc1a

  • SHA512

    f68f75836561e6693d982799a6907f0c255ab52bc84ac03213ceb6c15409b18ef0405556edfe867f39ea61df5c6b3860be3301353699838086a6e5f1e13a5cfd

  • SSDEEP

    768:vevDNGja1TxGIP+tZS3XpgTR5t+jZqt5RYVMQY24v:0NG21T4IP+tZ2XmNz+VqtfYd

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2