Extracted

• • Target

    087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd.exe

  • Size

    1.4MB

  • MD5

    30664b17b297bc3db34968f239360c6f

  • SHA1

    a4185b8ff9e045033d06701e200be57920753754

  • SHA256

    087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd

  • SHA512

    e178dd795f63ddf55ea4abbb9e9b44d493138a1be5b3b3c2928edfd59b8675e0192f223f986230854e1c8855d06041363f6f389d7d20390686e73be16acba0e1

  • SSDEEP

    24576:lsO7OVJ0W//bLLK6tsPdEZ+gqBnf5B1M8We20/ccvLpxBVtra:zixL7Z+gK28/lng

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2