Extracted

• • Target

    65ccfd374c9c9307743c7a619f9775374138e1d4cabd5b7c7566df078e9d59f1

  • Size

    622KB

  • MD5

    5e33de806d1f64c1f660de957fdffb12

  • SHA1

    119bb43aa965c46aa80ac9e8727c70f704183c70

  • SHA256

    65ccfd374c9c9307743c7a619f9775374138e1d4cabd5b7c7566df078e9d59f1

  • SHA512

    7ad04bbf8d0893978b95b78b1301f46ff5ecde27f51d5f05c1572cbc3d995ba4cf9e3e65a0c45af4b9b37f591bc274777de533f6fa49099fe0ac905d5bde1740

  • SSDEEP

    12288:OKfFqE1geqy4iuxpuNG5bsNovF+p+BwSyvCw0eD8o+P83:OKUE7P4QAJsyFm+SSs0eD3+k3

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2