Extracted

• • Target

    1a8751c20a763aba2b5a046623a1f7d8.bin

  • Size

    7.3MB

  • MD5

    1a8751c20a763aba2b5a046623a1f7d8

  • SHA1

    9099c89e0cbc3176c83df3fc5a7ca9335f175e71

  • SHA256

    1ea514d4afd80ba9d580c76fb0edf0f6b06bcddc465a8a9f6a7ae6a1daecb5d8

  • SHA512

    bdcc1b6a6fb2349bbaa175f4ed87ceccd779ce346388ccf91d9c732683abc0adff03c9025868d8436addf375d0c0211fda87a8fb7ce2b97db7ec3446d5ee0a1e

  • SSDEEP

    98304:2FRAZVUiZ9g3dTk7PMIiszVNdACmpCw0:HZWtgPj9PdACmp

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2