Extracted

• • Target

    7f695d676133bd1975874fa558199ab42e8c1c14d733076a3fe2f369bbf34898

  • Size

    1017KB

  • MD5

    f955974ce17000d557791f5949e68b03

  • SHA1

    081510fb12b60dbf4ba794c2d9fb8ad5a3c8c773

  • SHA256

    7f695d676133bd1975874fa558199ab42e8c1c14d733076a3fe2f369bbf34898

  • SHA512

    264441ff7e114dc30ad6c98b1f6214554d86ad6786901e5bdb13e2149edd8965cc6b556996f74091258cea1949f3293ebd36f52fde84310edadd2f3e4f4f0f73

  • SSDEEP

    24576:TAHnh+eWsN3skA4RV1Hom2KXMmHa/4P9+O25:eh+ZkldoPK8Ya/4Fq

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2