Extracted

• • Target

    e1ee0a7a8fd5ab718db2a542682db606279d70aff8414a41737d9ed615a64dc0

  • Size

    335KB

  • MD5

    bf5f5c222e7d6bf8c79d073907d780a4

  • SHA1

    bb1b4cdf8fce9526e048da6de37072292438f3ad

  • SHA256

    e1ee0a7a8fd5ab718db2a542682db606279d70aff8414a41737d9ed615a64dc0

  • SHA512

    e73fe89b6e7a6c7046b8e8836b5cd9907b1bf6b7dae5af0847bbafb05e5df1821a3a67228688b54907d12823b9066e5811d716865b19a8a18c32375181c17fc8

  • SSDEEP

    3072:h4bOt3ruVu2DqVL9clZwlcCk2w3v0MmGayU+x9:Zt45+Q

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Contacts a large (4266) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2