Extracted

• • Target

    0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe

  • Size

    1.1MB

  • MD5

    4361072f736089c4e2c5b7a6b4083ccb

  • SHA1

    3e3ea721cca3b00510b5b43e48214c8a47e0f9f9

  • SHA256

    0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636

  • SHA512

    dc4562c16c2873b9d7e7d229c13bf6e225e025ba4d8a3e664608c542c97473aa061d045608833b0854eb37f27673cc167af332204a5551e4ca58a9a28ff4df06

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHak3+H/xSPFvm5:gh+ZkldoPK8Yakg5aa

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2