Extracted

• • Target

    418241E8BBF66D6EFC7A37D250E0486544F141FF5405CEF887216567164E7D83

  • Size

    33KB

  • MD5

    d45d2fc3e002516560114bc996752ec5

  • SHA1

    16ee066cfdd7efa3a9547b2d43349f6b9d4a68a1

  • SHA256

    418241e8bbf66d6efc7a37d250e0486544f141ff5405cef887216567164e7d83

  • SHA512

    662575a9c7e64c5bcbbcbaffece90b035c330b8dfea74ba99000ef08d9c5e3b01986f370bf7a6b1d35a647550846a295d52d172d7206f42280feb52d3e5af07b

  • SSDEEP

    768:bFx0XaIsnPRIa4fwJM0jTf1C8p3Hlfdqs4Cl:bf0Xvx3EMATlp1fd3j

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2