Extracted

• • Target

    3e79fc95acbfbe53ef642e5b88edb806c45c6624634ec9b8a355d16dc72c078a

  • Size

    46KB

  • MD5

    e1f38ac4318814b4f2006f9311702fbb

  • SHA1

    9d4fce1aeaba9167eb9d6dc7de05dfbad1e47ef8

  • SHA256

    3e79fc95acbfbe53ef642e5b88edb806c45c6624634ec9b8a355d16dc72c078a

  • SHA512

    4d5f16200181e69b14500ff86937b23d9d7493429580605e55a5f697f1e3c45ab66a92aaf1f66e834601a7777e16b22432fe7a862aa56327c97558c1c93315d7

  • SSDEEP

    768:hhYP/k5jiYp5ebg2BRhkzzZXBGuVyyARX0cI6lJMyfOkr6ff8tMz4Fxj:hhys5jhebg2BRhYzZXyR/I6lJMyxr6f4

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2