Extracted

• • Target

    55929fce47dae8d280c401d4f654eca31fb811fd83b0f437ec5d085ebab13452

  • Size

    1013KB

  • MD5

    936f0735c3056dd0429b7e7a381e14de

  • SHA1

    9a3ccbd562d15249409f62c922ec1051bdf30d23

  • SHA256

    55929fce47dae8d280c401d4f654eca31fb811fd83b0f437ec5d085ebab13452

  • SHA512

    3845fd314b379c90d0469ae99ae6f358363e963f7f83fd1892cc988f0a724ee4a2f67abb1a649e8191a655819b1e9d0ec01aa2962b0a51604e6b4ac9e3a1f168

  • SSDEEP

    24576:XAHnh+eWsN3skA4RV1Hom2KXMmHaVv1y9ycXXP01r5:Kh+ZkldoPK8YaVdG8

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2