Extracted

• • Target

    056c3769a51cbae4e0d61d89f45a857b

  • Size

    759KB

  • MD5

    056c3769a51cbae4e0d61d89f45a857b

  • SHA1

    03c65baab74eac7c8ed2d43ff6c928c1e8d4f411

  • SHA256

    51e70e3292e217da70cfcb15c86a2141256c54cbeb34d0ad662dd6462ddffb70

  • SHA512

    e4e65a617e0558b748531c2731956d96371d20fd16f8a9dba8b142ad51dc63b0e18a3ebe627693a560ad87e1f31af57950a086e03adcb90e22eed33d34f7efcf

  • SSDEEP

    12288:efIkfVnlb8uYhkOH7hooLFo0DGy6RIq/hlJ:efI4Vlb853WoLC0DGZ5V

  Score

  10^/10

  agentteslaagilenetkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2