Extracted

• • Target

    84882e01b7e66e2cc7ce049292cc4e60510a0e31afd579d9b3fcdafd7b760415

  • Size

    797KB

  • MD5

    bee2fd58a1adfba6bb5ba888930877c1

  • SHA1

    1a71fdb0c64f16b01e4672e2a0571ba5b7f81736

  • SHA256

    84882e01b7e66e2cc7ce049292cc4e60510a0e31afd579d9b3fcdafd7b760415

  • SHA512

    91098f19d2244f3c73a5f75c5469b435fe32880732336824f7db288c4d062b7d61af478eea531cbee378b4d5d61c45d71b94b91f418ad554df5aaf2064a72fbb

  • SSDEEP

    24576:6tD/614lC1Wr7qlH+U59JOe9xX+SP9kI:O6alCEr7MHJJOeB9

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2