Extracted

• • Target

    MalwareBazaar.14

  • Size

    1011KB

  • MD5

    9c2b69ea402e6279fb1a78264313dafc

  • SHA1

    d7aeb3b3a6a8bfc071df785b53a79ffd324d0726

  • SHA256

    9cf5a62a4f7dd38bd1810c9e6bbcdd36581e1c7872bb8bbfd223f36a5d6a95ea

  • SHA512

    7ece462d8c6a5cc07b0c25a3495c64e93c02b5b78574ac78cdfb7a99360284f3731333d8c9431205e09f4a4bafafc6ac73c3ec39c2024d718e8393652d234364

  • SSDEEP

    24576:TAHnh+eWsN3skA4RV1Hom2KXMmHagZENqfSIH5:eh+ZkldoPK8Yagaqq0

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2