Extracted

• • Target

    NEW ORDER QUOTATION.exe

  • Size

    616KB

  • MD5

    792108a635b2d39638f3209191ebafbb

  • SHA1

    8c4f19d030c38f85b87f803f2ba8948929a95bf4

  • SHA256

    7f2803d474cf6b1ca96e58a16d0a46ad611ccb5dabe721fb7818551f18799aac

  • SHA512

    2be121309b52239fc8b30c827c82f74ecdc4f22de0aef19651c35380125b76ba806f36e6dd5a7c88a4aeb2a4ffa09e100b8f095988342ab5fe6cdcdc3ebe9a54

  • SSDEEP

    12288:368EqQkxswcXKC2zNWfm2YRm5sm2YRm5hkxswcXKC2zNW:DEHZX9uWfm2Yysm2YyhZX9uW

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2