Extracted

• • Target

    0e8fcdc410b7e7cd6c985a9a6edda567e1734578fd9e27ed360515227880d266

  • Size

    741KB

  • MD5

    0a6d11b6c53602ee2fad4043440d66df

  • SHA1

    4b519750d731eb9067e64f07f3de5df62ea2263f

  • SHA256

    0e8fcdc410b7e7cd6c985a9a6edda567e1734578fd9e27ed360515227880d266

  • SHA512

    48693fc8d8bcd37be69b424665e459542b39872da139acb2a5ecd2686e0a2acf636a1f089df146d67a072b2af9f20816efbef65e689003b5906b653660c4a4ca

  • SSDEEP

    12288:QfLq6svbQRuLxu1AboxtOnUwgOFoE0aWTjyLEUpcyXOxBPrwF7b5Ai7nETqBBzTU:Qfjs7xu1NvIJdi1aNAUpcygeb5ADqplA

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2