Extracted

• • Target

    72add732d0c20cb251c47d3a5128454c2c3ee7520c9ce8788899fd86176ae5b5.exe

  • Size

    1.0MB

  • MD5

    918d519fb50fb3093643a7ef606d22dc

  • SHA1

    59f7712b5af9c69979a0c3ce1c4e663e66ad4eac

  • SHA256

    72add732d0c20cb251c47d3a5128454c2c3ee7520c9ce8788899fd86176ae5b5

  • SHA512

    d0e224c92c5003b0518e3532ef1c45682a242bd20324776e71d19bd3abf42f208663bcf348916c42f4d852638655d6d9c548fbc43464f97c8c4faa1216847e59

  • SSDEEP

    24576:3AHnh+eWsN3skA4RV1Hom2KXMmHagTuL2P5:qh+ZkldoPK8Yag+G

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2