Extracted

Extracted

• • Target

    fad0d8e90ff191c8ba6dfcab31ae3ecb976a15ccf5c7ac1180964142f4e07aed.exe

  • Size

    1.2MB

  • MD5

    484305e1505b7a53491fffa7443ae794

  • SHA1

    9b76c3079e48e0033b2f5b4dd7d1615da33ea97c

  • SHA256

    fad0d8e90ff191c8ba6dfcab31ae3ecb976a15ccf5c7ac1180964142f4e07aed

  • SHA512

    1dc2bfa17c59ac7ef6ed9a9c030cf53379195d16db08b0956c8f24d6f113074306741e6aa4f8ea2bd6b8e02b40febe0f2331d67d3a7eb661c367262b8db62819

  • SSDEEP

    24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8af9e7TLyB:mTvC/MTQYxsWR7aVeHL

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2