Extracted

• • Target

    3ca97868610a7b67c8b81b94cd785980a6243537c83e643261339e2bd6f57608

  • Size

    629KB

  • MD5

    3bfc178c2856817408c8da0fefb64029

  • SHA1

    1358ac2474324c39d577d4c00d4d70d196fdc1ea

  • SHA256

    3ca97868610a7b67c8b81b94cd785980a6243537c83e643261339e2bd6f57608

  • SHA512

    0feb82bcb311b8246dc60ac643f1ccb238fdacbda14214480b04e4ca4438bcde3a3719287ce394d3827999e62937b6383c1f5a32865d0546f3f907d24ddcc439

  • SSDEEP

    12288:yKTOJlyDRKPnQH7jQl8y+6xTKEl1atja3A73sb+:vb8Pnd1HJv1Wj1Lsb+

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2