Extracted

• • Target

    496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686

  • Size

    1.0MB

  • MD5

    9167fdba7412a6714d5362a3281eddd5

  • SHA1

    faeda2c77c905b14a31749117f82770717a7dced

  • SHA256

    496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686

  • SHA512

    c66020878fa37fd130b3cff8726c91380448f071369c0668a78a143bda3b84eb204e27b956fc5c81ff34d9e62fb0ec2c0d91354605510eeb31efbdf6a954bfc6

  • SSDEEP

    12288:ZEK1L8WtogCbvAaUFU28u/gz0R2Jpy0fTS7DXE4jmD/V8vfa77tP+h2s6ZPcAZc9:ZIJYU2V/6pyCOD3jmllPcXV

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2