Extracted

• • Target

    20c71940fe5d447f7561bc731545b698a3632dfda6022194f0dfaf9500a3ac59exe.exe

  • Size

    354KB

  • MD5

    f3796fbbfb123abdbf9799973c5070b8

  • SHA1

    d1edefc94e4432f766c26fdba11c7cd7ccdde625

  • SHA256

    20c71940fe5d447f7561bc731545b698a3632dfda6022194f0dfaf9500a3ac59

  • SHA512

    8b8e67915ff11b9edfe3d2f54a206d55195caec11e25a6b66dbd80ebd874db1f3d97853440e8412fae60e7090ffbe2d3a6d3e031f8cc0f58db37ad2a1f86c543

  • SSDEEP

    6144:8LN6EGibegzopUODduX9Lgqk5qll6WTfTmEGX11Oul+H6LEAVufKWS:bxNwEUOD8QqbR98zOe66LEgw5

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2