Extracted

• • Target

    e08f73c603d9c50359239746b14c02311b87ee6b35a40bfb9b4b59284b38b709

  • Size

    965KB

  • MD5

    6d14dc249d6d03f3c8465da485effe1d

  • SHA1

    8081fc882ff9c540424444da05aabc92f0c00580

  • SHA256

    e08f73c603d9c50359239746b14c02311b87ee6b35a40bfb9b4b59284b38b709

  • SHA512

    23d061ef7f519315fa25c193a3227148782b87cc23e178fd765e4d5bde7293677619d1a5ac0e41e55d2ee2b7b176dac9153069582414615e3329db20f13abff8

  • SSDEEP

    12288:2rJukHnpzE6jD/62iNG5nF8XsTIwpRsVbP4DgeDPQ9AkCRj/V/IFL9dfdh1lbija:etHpztD/61IfTBRxDrPQXCNJGTfdh1R

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2