Extracted

• • Target

    Después de 4515457428.exe

  • Size

    1.1MB

  • MD5

    d1c94003a566f463d0aaa30af416667d

  • SHA1

    ab5238ffc8f7ea4331fa44ebbdb6691c2cb0bf06

  • SHA256

    0d49863fcf5e744d33391231182706529b25f3043cef1ec6b187255cfd6cfccf

  • SHA512

    167442392ede7057e662a5d19311e68712635da6c4a016491dde8eddf35d00c0200485e1058983fa88a63d4516871d496804ac1110a75aa0c3dd4cdf9a8c2576

  • SSDEEP

    24576:yAHnh+eWsN3skA4RV1Hom2KXMmHavUTXC+sP6ylgBSky/jMc9v5:1h+ZkldoPK8YavUTSbvAKIcT

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2