Extracted

• • Target

    61687c5da9d2b387f50b67d32a7809f1c46d6f9f5982bfd21f30d5dd370cfe91

  • Size

    1.5MB

  • MD5

    90495693a89df9503ad1b930a5720b79

  • SHA1

    615a433536caf24693750d4ca300f420afe49f7b

  • SHA256

    61687c5da9d2b387f50b67d32a7809f1c46d6f9f5982bfd21f30d5dd370cfe91

  • SHA512

    afa9285016758ae411a0fff70b0eb15f582f591c56aed0768863db3bab8417a2b54d7e6da60789789f44d6433ae1056db028aa3d7521c955dab61decff27cb60

  • SSDEEP

    12288:bVVnEAmDPLYLZixKNvXXWXzn9Cj422FXYb4AX8adfCTZ1ybWQ:bVVWLYLkxKNvGD9Cv2mb9sadgk

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2