Extracted

• • Target

    e909f6d833125f008ea789af8fdfb40041c2fecbca437a8f0da7e289efbebe89

  • Size

    653KB

  • MD5

    049e5298dee90a234db7ff0336e42361

  • SHA1

    af7026ba790d977e066ca6e5f158196583127cee

  • SHA256

    e909f6d833125f008ea789af8fdfb40041c2fecbca437a8f0da7e289efbebe89

  • SHA512

    74150316ccd7d0ea5a86c3ccfe8dfdc28bbf2c30c8f1cf4fa84cc3c148976e71c32327782db898434ccb8ac4cf66377d7778ce990a8f417e8696e536bad2327e

  • SSDEEP

    12288:V45+po2DRiWedT4GE8diPROQnv0vJj6OiieLA14th+CQkcVNBpk1gP3oCWbD:g+pJUWcTJy5OQv0xmieG4T+cclqCP4Cs

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2