Extracted

• • Target

    f25b4d443e13c4513010a0ba603931a82cd589c04341caef90b0177d9f2a4022

  • Size

    11KB

  • MD5

    7fd60405bcf546ba7a16c09dbd4bd28b

  • SHA1

    7520d69eef64b1bfcca7f6d72d6709c14e8e84d8

  • SHA256

    f25b4d443e13c4513010a0ba603931a82cd589c04341caef90b0177d9f2a4022

  • SHA512

    88c6aeadaa0f973233642d39badcc381fc8c2291cc8624aaa5a309b5d12d85c61977b7bbf756f31af2653ad6169f7370d43a73c9ca1934724793753d7979e06b

  • SSDEEP

    192:HDFtRVeJtzs3EQM8OSVd+myDGOWH3dw7DH+N0RzJCVpPgRwVN2bddccFvQHIxxuG:HDFtRVeJtzs3EQM8OSVd+myDGOWH3dwN

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2