Extracted

• • Target

    f5d965fa4068c325dd170be481c472f5.exe

  • Size

    764KB

  • MD5

    f5d965fa4068c325dd170be481c472f5

  • SHA1

    1890c48bd1d7a580422a8ddc8b63eb528f5949e9

  • SHA256

    b954ae1f5c52de5155a9e1e54d5ab96a940dc715d2624ff48c1839dc6ba1b53f

  • SHA512

    a7e488235e4d7ddce27d99bcf080a57d8790369214cac4a297475fdd6211cc05a2abca98bd4857e14c2c04fc3f76520d3e003fc942ada3ef9e60d10d52f75842

  • SSDEEP

    12288:1x3fW/uspnQATtxZ5QHfRANT5ZBOFb8CvHMF7GXKs:HW/NxptkfR2ZBoi7GX

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2