Extracted

• • Target
    2026-07-30_e5bc224980ebd3a782a428684c25ff9b_agent-tesla_darkgate_elex_hawkeye_maze_nanocore-rat_remcos
  • Size 123.0MB
  • SHA256 8195d1838e16843d8aad53d2bf132f76eacbb85eeb0392ea5eed7a3df87e48cd
  • MD5 e5bc224980ebd3a782a428684c25ff9b
  • SHA1 b93059484ac1f1c95d37d8d9890e5f60d90f090f
  • SHA512 a26f44e196a15b526e64ca73c8e439c1fef9878b9c91ef4988b57711a6112807a23d8660419878aa670a7dc94a1d6d2f8f011690159f704efa2d6651adc66c61
  • SSDEEP 24576:WCdxte/80jYLT3U1jfsWaC+M337p2ZfQ:fw80cTsjkWaC+uU2
  • TLSH
    T19A58AD2273DDC370CB669173BF69B7016EBF78614630B85B2F880D7DA950161262DBA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2