Extracted

• • Target

    a31a05fdd5fda2394efd7ad5f83a023e6df7b8297defd41722e626dfbfc228e5

  • Size

    1.1MB

  • MD5

    626db78732a6bcfbc785dc88a9dff52d

  • SHA1

    31dd1cba6d9e5d7131827f12fe589a8be4d0baf1

  • SHA256

    a31a05fdd5fda2394efd7ad5f83a023e6df7b8297defd41722e626dfbfc228e5

  • SHA512

    1644bc14f73fe39abbe97bf36d4a09a178dec3fdb6703c148d743228fdca002d47a65ba0a1aa812efa5b044079e87c3b464c0396667f587abf5d7e3d738462d9

  • SSDEEP

    24576:aAHnh+eWsN3skA4RV1Hom2KXMmHaLQSItlWw+hB/l/O5:th+ZkldoPK8YaLvU+vG

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2