Extracted

• • Target

    c685ab98e1910af3a51286a6d68d706e2a7be5298f74c061f98b9e87e290d357.exe

  • Size

    2.0MB

  • MD5

    d81b4a2a5f96fb13ba259a1fae296ace

  • SHA1

    ba47840dfff065356f10a05464c75c6a4cb70b7a

  • SHA256

    c685ab98e1910af3a51286a6d68d706e2a7be5298f74c061f98b9e87e290d357

  • SHA512

    586908b31e61657f9f55b914f5b3a5b232ea1d1219025d2765a8d5f5bf35aa127d610d82c597bc38ddc8d69167179f068949a72ae28ab2f9732f0b2f76ba7bb8

  • SSDEEP

    24576:kynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52tOXuq01dKqOFCBvx1prO:VjN3CdJ81nEQhs30eruqsrOFCBbprO

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2