Extracted

• • Target

    5bffd302444843d593e6bd69c88e24fdefc2f27b532e935b9c534b7a795aa9e3

  • Size

    1.4MB

  • MD5

    d97d616e49af21bba3536c700491d8a2

  • SHA1

    5a8440ae47f29a9de633d166c1b1c70ad4f2e616

  • SHA256

    5bffd302444843d593e6bd69c88e24fdefc2f27b532e935b9c534b7a795aa9e3

  • SHA512

    edfdc77c1ff9989b3a430ef8ced476d2ac7a380fbd897f1fdd493f99d490e36a29222cd73b2d9a68e2a9ac63c37011095d3e1aa438c399e27a861fdec3ed0871

  • SSDEEP

    24576:3STO2xeoGIpyDfZH6s5KeTzLAJjS/iFvmRdiCr6Rx8U5X:ixocIzLwa7GRx8+X

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2