Extracted

• • Target

    5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2

  • Size

    2.8MB

  • MD5

    866d7ea6d629b641da79144a95b929f8

  • SHA1

    46f55b35cbedeaa47a342e84bbecc53c791bf1fc

  • SHA256

    5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2

  • SHA512

    b36a5fd13100405e836cf3ff5d72de0a2ec19ac9a332b13014d4c207048d9c1c7148fa16f19bb3224abf01719e94e2a584a0f58f43b85fad6c0903146fdf1c49

  • SSDEEP

    49152:qeVIh937bl8Kaqe7rOsVsjkEPn4D//TM+j4uFEWnDEYTC77KommOtWdSXt8Gj:qeVsaKgbAn4D//IcbF/nDLTCHKomXyOF

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2