Extracted

• • Target

    Revised Proforma Invoice WSI116850PF.exe

  • Size

    884KB

  • MD5

    eac45e7940e2536662d67f5c2bb888f8

  • SHA1

    99accc50514d38dfd74883b10789a471f4cc2bca

  • SHA256

    3e1f623f0b2c1b85bcbca396bbeb79e06db39138a004c14201827ed1a8ca377a

  • SHA512

    9053620605e242827e03dc5632e55dfef2ad839a63f5ad2be0d6e0a0a750e46c20e6d944623518e68753838f1629fe72ef5a48f780d12fbc33afef348ce16fc3

  • SSDEEP

    12288:EW0lwFqIwr+i3Tp3OQwN5V2cKxZMXdKkDkB0c:RZFwTp3duL2xxGKoy0c

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2