Extracted

• • Target

    0f29f401bd500ea29a43ac6c020052560c75fdd06d6a410ddda7c4441e0e0be3

  • Size

    830KB

  • MD5

    524a2c9831a6a569ea57fa93cc7bee08

  • SHA1

    7670852307195442a555f550d5212ecb9202b4a4

  • SHA256

    0f29f401bd500ea29a43ac6c020052560c75fdd06d6a410ddda7c4441e0e0be3

  • SHA512

    bad1a45ec956dc381d506c60fe522bb34f9d57037bba609e8f519afdbc70bb967b0f3543d82ef38b86d146b5edad0881590db699d9b5ec85e8bca5810fbfd996

  • SSDEEP

    12288:4zHSh5nF8ME6jD/NP/ntrTmp0cAce8rYRa40UidfwqniOgGJIfcpcbOjGEkXEn/4:4TsPtD/NntXh642fwCtgHfmcb

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2