Extracted

• • Target

    28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c

  • Size

    67KB

  • MD5

    1b1e897906433a078f95d52051443c15

  • SHA1

    305ee07245f1de1525f9379374250d695e487a4e

  • SHA256

    28fc24022fa2071443e9dd16f85261f76cf27d6a7ac89fd8e93a2f349ccd250c

  • SHA512

    9a33d9300479c7a631ea84e16814091de3257f6495a8f0a4713119de3b4c2b70a02ddff4e2d6e4aa09665828aa019ab0e91d1d450f066d3ab735751ab795e34b

  • SSDEEP

    1536:FWffnB8k6Z7f4wpKPKoM220M64IBJKwXg32CZikQ3mVKJchjDK4bpr:FWXEZ1pmzPMrIBDg62VKJc5W4bd

  Score

  10^/10

  agentteslapurelogstealerkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer

  • PureLog Stealer payload

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2