Extracted

• • Target

    88df32aa4765e8db133c4c2f835a90f7889be2c3a8facc9b04db0c1a9422aa9d

  • Size

    825KB

  • MD5

    0a39bf5d4de076008d2d22444da4c399

  • SHA1

    34b34d768732b53bb94e87d8dfe061b62a543881

  • SHA256

    88df32aa4765e8db133c4c2f835a90f7889be2c3a8facc9b04db0c1a9422aa9d

  • SHA512

    b64078159a8211988501276f9a2d4593848d734ef0bbc98ea036c8041513d5aec66fb161ae8ade7f608cc8e02944b3ec27d6f872df48c23860e1087345795447

  • SSDEEP

    12288:c45+po2B1FmXmB5Tf/9TSXQ7l9O8QkfiAk9Xs7Z3aTSPyhe+ZEw3zPDyKMHPTZtn:f+pJ1AmBLZ7l97FeoehRCyPDyKMvO

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2