Extracted

• • Target

    9fd0c32521c7d152ba2b6d68f90cc43f6ead072c6030601ae0724889debe4234.exe

  • Size

    804KB

  • MD5

    1d12b8064c33cef04ff272bb099d4541

  • SHA1

    7b80053875042ab5946d73b4bc9f5d06abf13eff

  • SHA256

    9fd0c32521c7d152ba2b6d68f90cc43f6ead072c6030601ae0724889debe4234

  • SHA512

    b17aee1f64c337874dd579e84487ec1ba4e891294239945e771a15ca034b83ee4673707272650a7f87deeca01087d9d43bb22f917515817083deef7d1c735189

  • SSDEEP

    12288:mDLUbbwLijB0wHjMpiGTd8dX/LhcqeFxXzXNuVPmdfBoItMUFt6Ysbwj366lHNNV:YLmiwO2xhc/XzXoIyUFtHsU7

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2