Extracted

• • Target

    7c365ce0e3489852c8e6680bab779495083c48961985fa64d34696b4e2e598dc

  • Size

    1020KB

  • MD5

    8fdddd6c1778965fa675530b23081555

  • SHA1

    7d436c8232a5a6044e3c15a18d662183f16cf3ab

  • SHA256

    7c365ce0e3489852c8e6680bab779495083c48961985fa64d34696b4e2e598dc

  • SHA512

    d01cb45ec86daf6fceae8d45417ad7dee1c560fc41ead0133216f95d6cdec9544e947e32b750c83afee14036d5b9f05ea0e89ac52cfa5ab61e37cb44a9582712

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXMmHay9tBlWDh5:Hh+ZkldoPK8Yay5lk

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2