Extracted

• • Target

    0f3ff1ded6ea1d1f1f99e20142508697e403253eeb8323a18476ff46847b22ee.exe

  • Size

    681KB

  • MD5

    90b792cf86d9afd7bbd1f48e5dc43cb4

  • SHA1

    10205a12730a7a0e8c6cfbeda590513e6162acf0

  • SHA256

    0f3ff1ded6ea1d1f1f99e20142508697e403253eeb8323a18476ff46847b22ee

  • SHA512

    a7ea940f8720fef323ff302d73ad677149fb42ac0a188e15cb26c6e202a203de934b1f5a2bcbee7e336cbdd71893dd9e0269e1aa83265d8ee6673f56f164952b

  • SSDEEP

    12288:7WE6jD/BFpk1ZzjJ4MrZ+UTuyRPFebWEbh2CKhdYpuUeAENz4:qtD/TOzJ4MrZ+5+eWEbhpK36uUXEN

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2