Extracted

• • Target

    c942ceb09e4b572fe2fe71a34146025c63c3efec48c79d743ab9402f6fa2f00a

  • Size

    901KB

  • MD5

    b74a27f1d2f59773c8fc41c831600fe3

  • SHA1

    6ac989c71bb3ffd45e728c4133edbe86a8373516

  • SHA256

    c942ceb09e4b572fe2fe71a34146025c63c3efec48c79d743ab9402f6fa2f00a

  • SHA512

    fb50dd90861a1fe3e896de6f858968ae835b5ddc4e73655db205fe55646f40a9e4f5155a045406ce1890de663c7f1b4ec192e6ca02afa8464f6820946d5316f5

  • SSDEEP

    12288:Y1IsPKApFUvR9VJnRHUaQYYpFRt1PT+v5Adcd+b9VowSws0:Y1IsLf05RH/QY2FT1PT+xAd/9VowS8

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1