Extracted

• • Target

    e05771e0ff928ffc39c22b34ae91a012231c27986ca8af9dce606f62c9e442d2

  • Size

    1.1MB

  • MD5

    af511189872d41f53c9f69d39bdc567c

  • SHA1

    65d242875b6475a9ac3739b0ad3a37c01068df55

  • SHA256

    e05771e0ff928ffc39c22b34ae91a012231c27986ca8af9dce606f62c9e442d2

  • SHA512

    4df5f06d0d2c861440c61efa22c0af117408d5270f6d3384079d693be9bfa92cf478d98f3473536a91cad64ae32b03aeba06ed76b76af857cbbafc505d9ab49f

  • SSDEEP

    24576:jAHnh+eWsN3skA4RV1Hom2KXMmHayu70nNaAvQON+N5:uh+ZkldoPK8YayuwNbI

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2