Extracted

• • Target

    8eb1f5551a27d2fe1366393c4fc787ebf70dd0d394e1d229bd8a5ba34f418bb3

  • Size

    807KB

  • MD5

    4b62cded4bd964e8d53d3787e4c35e74

  • SHA1

    b76cf14bdaf01ea6139603ca2f236191e1585980

  • SHA256

    8eb1f5551a27d2fe1366393c4fc787ebf70dd0d394e1d229bd8a5ba34f418bb3

  • SHA512

    a0316cf29230926eeed07cef2de4dd99a07886b81cef95060eeb8e0072d1f4240e4130e2c94f9d6369a0fa0badb881199e2fba4c2103f7d80c29b6b513367f57

  • SSDEEP

    12288:rk5FKCbLN0TH93TsFad92nPDo8kV3z7fPyscC6Qm0CiTB2Qw:Y/DeHNTsFnnNafP/xRX

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1