Extracted

• • Target

    1b1a6c5636815d8778754725578613cd8809a0b393c0104d5ead0f1f33d7f558

  • Size

    1.1MB

  • MD5

    e2de058cfd498c235444f14cab7aa41f

  • SHA1

    8f0d9f0bb0bb5985ad8aa19ec49b43b5b39f7ab6

  • SHA256

    1b1a6c5636815d8778754725578613cd8809a0b393c0104d5ead0f1f33d7f558

  • SHA512

    00f99849f8bbfa8cf025262c02c026de6c632e745a3c1744fc45ff0d9a5c522fdc8fc3d068934801f9af7fedc8f3091a89b329733463e2107e1ad12b39323198

  • SSDEEP

    24576:5AHnh+eWsN3skA4RV1Hom2KXMmHacIZ02cftB8wxCj5:Ah+ZkldoPK8Yac0fcFB8wk

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2