Extracted

• • Target

    aa229130ed51294a06ff9dd26a0891c5da383cda41ceb0cf49e0878eb0ee021bexe.exe

  • Size

    886KB

  • MD5

    088c8c2c2c8d6b7708c8c01fb400b9a8

  • SHA1

    f00831285d28f1a214afd8f6237fe5e5763d2b71

  • SHA256

    aa229130ed51294a06ff9dd26a0891c5da383cda41ceb0cf49e0878eb0ee021b

  • SHA512

    4958e80a06b48a3661671ae3a2906ebbaf7d7fde60d5c8ebb0fa7db74f8f472b8536867eb3fb329032759970ac92a13784f1c094ef69e48cc14956ca906a29bd

  • SSDEEP

    24576:EaMO8R992kY3dIhSElcdSUi/RGaq2BvoAVpTqh1q:vj8LLY3KhtysRdDTd

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2