Extracted

• • Target

    SecuriteInfo.com.Trojan.MSIL.Crypt.15320.542.exe

  • Size

    820KB

  • MD5

    bc3766383208566e84c687962a5f1e46

  • SHA1

    5ecdcd2adbeafff9009d219ff39218d87f4bf59b

  • SHA256

    0f5adc0a7be5efcd4fc8192286bb373fea270170782cc83c71b616dde41e0157

  • SHA512

    237b60664f36e2f75e9f5c83cb1918e96f076e0646cec1acbb71e5ccb61c683092c6c5caa45abc75e1aa694f9f6b57368fa905ff1d480c2b2cd44444693f77c1

  • SSDEEP

    24576:/scFcWv/uG2qeWYZYmGe8eC5DrJwTEqHytjkQX7tM:7Fcc/uG2RYLQGWTaJXRM

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2