Extracted

• • Target

    INTERNETCACHE.exe

  • Size

    681KB

  • MD5

    d29f7f2967179adb21e755ef4e2fb713

  • SHA1

    cb4f893ae6c02fd6ea734661149d28f321afadf2

  • SHA256

    1ce24db77fddb5022011d0407f93d6217b84ad6e18bf9be127bd8d2808423b73

  • SHA512

    19e0c6262d14a8394aeaa5caefe84da356197fe07807bf29016ea24012f20b718e43b0cbc6ff074002e974f0533a0a9836fd73aceea229b32eafe5c52a0b7094

  • SSDEEP

    12288:CiTB2QwWASA359TWdc7qN+J8Z8OkJ744qs9dH:X5LaFWdj+6Z8OP4qs

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2