Extracted

• • Target

    SecuriteInfo.com.W32.MSIL_Agent.FPI.gen.Eldorado.9335.31098.exe

  • Size

    51.0MB

  • MD5

    2d675409d5a639aebaaae6cbe70978d4

  • SHA1

    42baae41cbff2ccc8bc2eae1d7d52c32ab1b45ed

  • SHA256

    c04609d67b1957dcc1c7aa13a5159c26fa5f5ac6a12de18d20c8d0c93ce25e0a

  • SHA512

    89c58df21e2e4aa34e6d18f35e36b92d650a256736ffb67233010028e8a8a925bc6597ea05e383d9f26438758d3f832e74e4ad79ca059efc06eadcf78d93c454

  • SSDEEP

    12288:hTq6Jolqr2/hB33Mi7E9UAFq6Az2XSAvO5s5oFmXESSdueH5qFyD:hVuhN7E9UIq6pvvO3FmXuLqFyD

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2