Extracted

• • Target

    SecuriteInfo.com.Trojan.AutoIt.1390.21633.8031.exe

  • Size

    1.1MB

  • MD5

    349d723ecd0a2370dd03befb829bbfe2

  • SHA1

    91035d07ec0a4f68cdf21a346f08a36c251cf553

  • SHA256

    713d258a9f5522e345d7ecf7b82e2f69c8eaf53536ccb9d582e27d0d981861fb

  • SHA512

    68e7fe24bae4a7e7e7272e37013e9d852d43a7d025bcec8354bca30ff7873f0ae5495cad39ad02fae8a43c9711ecdcddd871e12bd1d95c9d6874bb81f77bbdd1

  • SSDEEP

    24576:bAHnh+eWsN3skA4RV1Hom2KXMmHam7t1SkxMEpXCm1cv7H5:2h+ZkldoPK8Yam7zS0npSmqvN

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2