Extracted

• • Target

    937700aed2b509a24830835935fdc9002f8782cba349c86c56afc1f64a35d037

  • Size

    810KB

  • MD5

    da62940a6a31aab14418eea025f6c7ef

  • SHA1

    ea35ad4c012fde3458a4480742dad7b2b3ddf608

  • SHA256

    937700aed2b509a24830835935fdc9002f8782cba349c86c56afc1f64a35d037

  • SHA512

    5721a148e6d0e56eca4452357ab5762f48c912800a5b63dc276f6287533b5ff805f3bbc94b192634053fc7591c413505f6ea1b39e9578ba3cf711b77d73d17a7

  • SSDEEP

    24576:g34/up+pJ4j9cMBAElaT8DGa5iGjYfPKP:g38PJ45DCZTvajYfPK

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2