Extracted

• • Target

    c6c31ce35e7270c349dec90b7fe15290f0a9bbf413883f61d27841a7158e0c15

  • Size

    121KB

  • MD5

    9e36d6ac7a12934fb7c600440b636791

  • SHA1

    0b28eddd79a56c5853e28e0474dfe672354f145b

  • SHA256

    c6c31ce35e7270c349dec90b7fe15290f0a9bbf413883f61d27841a7158e0c15

  • SHA512

    efb804202f35c5810e31a940cc60857d691ebcdc1c7a1df323bf028fb150211fb9b4125181283a956b3a1bc095c737145e3ff64baafd4daabf5033fceb6b96d0

  • SSDEEP

    3072:r3ViQKDg83EYB61Rkf2CXosVp9ggFHlPy736SY6mripUqVu:r3qU83l6zS2MX6gFFy7Lm+

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2