Extracted

• • Target

    783c69fa53b4828d0768b9f5acc70f02dce5c507fe52f5ec91d483dddabd1a46

  • Size

    693KB

  • MD5

    f0b7a99b8cfba702faab20fdeb6a9406

  • SHA1

    4446531ceef5dfb58d735d314b49fe827d437f87

  • SHA256

    783c69fa53b4828d0768b9f5acc70f02dce5c507fe52f5ec91d483dddabd1a46

  • SHA512

    ca5f12fc7df3b10509ecbbae86e52f6b3cb37354edfb0e668bef1f53c1f91e6e01d39ed5672c5593494b1b45753fd3dc61f46bfd233a3c61bf012bd481efb996

  • SSDEEP

    12288:spkwllxoYWpw53b7PwrlvsMDVxGwznKL28EWyF/ae3Sdjctq4JPtd53rD22M:gkiEYa83wJjVY2H9hJ3Sd349BrDe

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2