Extracted

• • Target

    SecuriteInfo.com.Trojan.PackedNET.2735.29595.3122

  • Size

    709KB

  • MD5

    2b578c0a73abc237814bdf0dcf080663

  • SHA1

    4b35c0b021d9db211fcbce84a6bde2a63b3d184e

  • SHA256

    7c4cd03c4541288c1a325c5b34f38b800fc991ea96d1681f037efc1f5f7e6cef

  • SHA512

    e08bbf22260c9379464542016585a725147c93d7a5abb909b9705003a55425ac08e5f79cf8f089d2de8f90cc03084ee4c15b6b79f849c697bf2ad96c4261676a

  • SSDEEP

    12288:lBtKZ/jr6S7JH4ydz8AZdGidwLdzepVZifNDeMV2KNH9Qkecyb6nOSt:AZ/jnVbTldwtgEDZv7eHV

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2