Extracted

• • Target

    449902eda30bb804e397aa0339abba0743a980411fd94d0b4f5796e130125624

  • Size

    1.2MB

  • MD5

    8e7f6c343ee368387b482ace45615adc

  • SHA1

    d27b2506260ece8b016c2367e56883949cdc9e1d

  • SHA256

    449902eda30bb804e397aa0339abba0743a980411fd94d0b4f5796e130125624

  • SHA512

    98cb04a53f901850865f4928396fb72ca4e45144854d916ef14d743bebd4b6bef738257842109cd02748cc40247f915e1292faa1b714bce0bbaab2bee881ccb9

  • SSDEEP

    24576:hAHnh+eWsN3skA4RV1Hom2KXMmHa066nnjqKoepHX5xUHr0q5:4h+ZkldoPK8YaqjqKoep354r1

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2