Extracted

• • Target

    3faa3fb47eee1a12bebe12d059ecad64b4d3758e63a94e945753c6fbc5dea087

  • Size

    1013KB

  • MD5

    9460f998e63ee65fcad497cd9c491358

  • SHA1

    b7b99071a80fa4c5ce10f1f3123c77149ec61dfd

  • SHA256

    3faa3fb47eee1a12bebe12d059ecad64b4d3758e63a94e945753c6fbc5dea087

  • SHA512

    2c960c685e15ef72d51902b1d1e007bed17c3ee3594389512322f4448edb6ede803d383092e392b38cb5b57b7b269bd25ef5c8b1a51f337fa4a33766f5acaf23

  • SSDEEP

    24576:qAHnh+eWsN3skA4RV1Hom2KXMmHaLXomgbGne5:9h+ZkldoPK8YaL4mz0

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2