Extracted

• • Target

    de4bc15775cd8399127b6e2024cef3f1a1feb343dd6d8a60916ec4c1e7b4cde4

  • Size

    1.2MB

  • MD5

    8d1ed16b33faf36da6ff6d3dd4a300e6

  • SHA1

    96ba1dd19b0613f28a0879a20a0bb98f51c1716b

  • SHA256

    de4bc15775cd8399127b6e2024cef3f1a1feb343dd6d8a60916ec4c1e7b4cde4

  • SHA512

    855e8006c20337b2e9575f37dbe33ec1007fc7d8ec0ec23122c2bd476a75d5f9557cd5df1aa0c8fff75314189a8c947f757bf5fae4f94386331a3c8970e771f8

  • SSDEEP

    24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8ah6nnjqKoeB+8TvGWUO:bTvC/MTQYxsWR7akjqKoeBFU

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2