Extracted

• • Target

    OC 4515632182 (Aprobado).exe

  • Size

    736KB

  • MD5

    be8e4666d809a3858fb36b6f7e3ce51b

  • SHA1

    fdc79d7233b040e6515c26b37060cc7fee02fe5e

  • SHA256

    418f67fd648ea090422672346c2a8f45ef1ce3081dea042676b7cb61652d146b

  • SHA512

    8bf3129000c2651fec731473a10f659a382e9ec7731444be245406c4bcb6d529b91df95dd53d1b43870122ee93653dbbe560829912195a579e0fa416eaffd5da

  • SSDEEP

    12288:DZCrZ57eykByazZCDWZl3aD5zJc34vAAEYbIg6w+Ds38OUKeKNarGluC7wJ+HRF/:W7ezA6EKqEeSjWG

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2