Extracted

• • Target

    4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806

  • Size

    625KB

  • MD5

    0822908fbfcc022427466310b7b3fed9

  • SHA1

    93f3c5538fc46196ecfa6a3c640764cddccb55f8

  • SHA256

    4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806

  • SHA512

    3f159709f418ee54b48fc4b5eea5b23883db9a8a4ff6c6028f452f1b3d48f977a939719f9a7cb37ced763ed7d76525d307b76e2f364a8b7209d28c5be9e93dfd

  • SSDEEP

    12288:nxXykKbChb02qKJliA8Zfq7ZOEGZzdiXaZxtQayJEUanyLz3qbIbLad1:QkpfOfAw3p8KBBnyfqbbH

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2