Extracted

• • Target

    1f1b25f3cdad8e6c86d32be6d600f7ae9d2494bc0c50ec689d48e1e2df944dff.exe

  • Size

    1005KB

  • MD5

    0bc3bfaf81eda87fd049efb81e506545

  • SHA1

    422f10b51fc7d98b5c442393a26bc2c11a2265fd

  • SHA256

    1f1b25f3cdad8e6c86d32be6d600f7ae9d2494bc0c50ec689d48e1e2df944dff

  • SHA512

    fb97476c0d1a24f03d8e085471135521dccb7acbcb9d9b54b4310fac3c14e9e4d8188f5e5fdfd126f66c071ffdccae0621e2bf4e800237b17a268507aad9ead5

  • SSDEEP

    24576:VAHnh+eWsN3skA4RV1Hom2KXMmHaEt8d7G92q5:Eh+ZkldoPK8YaEt2G9j

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2