Extracted

• • Target

    651498bcff0d0ebbb35662b373dea9a1ba1867d02c7cb6c52ca654b26e121ebc

  • Size

    8KB

  • MD5

    9537d2eec4c0e7dfccf3a6b8e4225611

  • SHA1

    8767cf2c1743e08adcd1fcce73b965ab67284a5f

  • SHA256

    651498bcff0d0ebbb35662b373dea9a1ba1867d02c7cb6c52ca654b26e121ebc

  • SHA512

    4db6b9f7f54c4f7090e3ded98984b4bbc06bb1b8d2e76b25ae788e82f431e68c29d658a078bfaf2ad7e3bcd396ed1830cdbe3999d70674e9cdec1514252c60d9

  • SSDEEP

    192:8BxTokynKLuBihQ5zW4W4r7fxiuWXDhMOMdh:83ToFnKLuBihQgyrYuWXrI

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2