Extracted

• • Target

    82ab836a939a5c496e01ee4d8b3380b0d64ddb0163aa3895359968260c4a7e84

  • Size

    565KB

  • MD5

    bec621264bdf6f2b1942f4fbfb856029

  • SHA1

    24be38a9957a68ce66dc2fe5625beef5b686b7f8

  • SHA256

    82ab836a939a5c496e01ee4d8b3380b0d64ddb0163aa3895359968260c4a7e84

  • SHA512

    0f5c3266848749191afef8b9a6e0d8f4c3deeb0ab9d3686975c9460558fc147e15a976d81a803229c278ca9cfced655b9325c1d871738170224255d872b92859

  • SSDEEP

    12288:jeh2YKVYkKEYk3xOyILeD7WWcjAIxJ9mp:Ch3KVAdkBkLk7bhIx/mp

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2