Extracted

• • Target

    mercy.exe

  • Size

    642KB

  • MD5

    a0d6f0661883d042576dc181c119b657

  • SHA1

    29e892f40d2e971fae717b107ca20a83e33b547b

  • SHA256

    4a5f5cfe6237d8ae6191f1f21ada6671ce1968e6438730051edf22c994c9c6d8

  • SHA512

    bd387819ce5588ee0cf4f9dd267c938ccd4aa3e1d174ba817578b336e468fdd8bd328b74b858f9e0b515fa1527faa87bd0016775479b95f8686fae7c54991129

  • SSDEEP

    12288:+uFFMGQIut7D7P1rDWi/IFvg6chCsRDss7uryZ8Uik:+uFFMz7XPRDWOIpuHesSlUi

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2