Extracted

• • Target

    95c5028d19bca4a67ab66b9642df90dc02cad0e5515b74a2325a199622d1fba0.exe

  • Size

    1.3MB

  • MD5

    701dfb3e64ea1a615676f2b19dce4821

  • SHA1

    dbd8ce6bc5ea51c48bb1542fdaefa6d0e6f4395e

  • SHA256

    95c5028d19bca4a67ab66b9642df90dc02cad0e5515b74a2325a199622d1fba0

  • SHA512

    ea56a14a75dd98fb8fae3d6e808e1b33fa54e6e049d0996f7228843c55bf3e86f173f9aa6c2949b818fc0ed78990aaac3763ebdad5fd0e7ee7b73c4f4a9b227f

  • SSDEEP

    24576:Ed5RjuP7KgZjiRDIzQoXBEH6s5K8b3LeTWNI6rGl2e5Ygro464:pR7O3LwWytl2eB/64

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects executables packed with or use KoiVM

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2