Extracted

• • Target

    5949a64684d24fc0ff1efd59b8c05b3622d26cf488cf8d21c0716af52b097f73.exe

  • Size

    831KB

  • MD5

    c7f4fed7f8977e127e454603e99de5da

  • SHA1

    f7272681e4efb8d271389a95841e9adce4b37bd7

  • SHA256

    5949a64684d24fc0ff1efd59b8c05b3622d26cf488cf8d21c0716af52b097f73

  • SHA512

    e690f8b8a43608f25b7110d74a0a32693a23b792565929593a4bb9766d3d7da49bf29e96e5b3ecc895e29972c1c4eb691c1807ebf78858627b9f8908702077cf

  • SSDEEP

    12288:dY5R3sx6pZ5nF8ME6jD/ps//uTPbCsDKfs7Sqbjpv/4z3t9KPIZuue1HAYsnY7qw:6pPtD/2nuT+3fsu8/o9wPIZu9puY1Ff

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2