Extracted

• • Target

    c3e5994f608f8cc633718a164f710294f04b1b49770c4ad08c87f3e4de04969e

  • Size

    1021KB

  • MD5

    6890ebf5482e1cc3540ca34d0bbeaef9

  • SHA1

    8c1cb5200369b658a5fb2cb4388cefa42d171fe1

  • SHA256

    c3e5994f608f8cc633718a164f710294f04b1b49770c4ad08c87f3e4de04969e

  • SHA512

    67dd5add62cb50a1b7ed73ab1e04a0da493c0129fa3cf8a52a35ef220d98584e42eaf9e58fed56318f0a3e456037df9c272b5623463a8a088ff3bd9829dc4bda

  • SSDEEP

    24576:7AHnh+eWsN3skA4RV1Hom2KXMmHayQL4Auj5:Wh+ZkldoPK8YayQsAG

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2