Extracted

• • Target

    KZWCMNWmmqi9lvI.exe

  • Size

    724KB

  • MD5

    357819113a4c45ae00b90d06bdd54f67

  • SHA1

    ed16e3a8b5d359f6f59cde2cfedc619bcf24bbfd

  • SHA256

    41c1924e758c705eab2c725624c7c01923601d805c3e4ebe6cac379e32ed4140

  • SHA512

    e0b1d910e4ff577c3bd50ddd6c26ad270c1c113645df887294113febb2f71c7905f7b1cc5e7f8f09a08ed11eaded5887f52607c15f6958c512ff3124727b321c

  • SSDEEP

    12288:pGL21ILpqe2cWjoI8F1P3FkbBrmofmjuFP6U74BYE3+FhjXmZdwwpIl:IL21ILpqerAY3FkbZmofmvQFh6Hq

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2