Extracted

• • Target

    f17888c39de05db240eac5f53edc8ad9c1b1512c428dfcce5078bb9636395a8dexe.exe

  • Size

    812KB

  • MD5

    9fdc58e77c21bdc493d017806c814791

  • SHA1

    87d45946cb600a4c1bcb30269187124c5fa0e8d1

  • SHA256

    f17888c39de05db240eac5f53edc8ad9c1b1512c428dfcce5078bb9636395a8d

  • SHA512

    104b1ac6a5dde7bbff09fd40589e2ff7bae999901b7eaa6ba5cb5419112fdd206a2c78445425a63905223e7d014250f2d4dd69a64820166f6be56996bb8a8337

  • SSDEEP

    12288:WWytW8G34/uK45+po2cOe9aPgt4npNKacCeIvzMGD1tkChTlCoXtn70IQIVAxqn:l34/up+pJw6BnpgacCeIlDZTlHdndwx

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2