Extracted

• • Target

    337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae.exe

  • Size

    3.9MB

  • MD5

    8aa7f15a75d78a3029a3da0ba80282c8

  • SHA1

    47249bc395517fc6ca5cf0837c6a66d551749a93

  • SHA256

    337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae

  • SHA512

    f17c78990077f8450e71a0c6e984ddfab9f7b55c9898999d3e8cb80d7925ca02432962a35fbc74bebc955a370082d9754f9a641a79f26ebf1dcf77a004b37369

  • SSDEEP

    49152:9eA3k5ul6MhfuPQoCGUiKxdszvdAQgFPhEyzYKsG6sVet39OOK:f6kAz9GM4

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2