Extracted

• • Target

    c9291b5718b7bd41f312bf6d9cf84edd6c57c49d6b6ed42bffd946724b44f149.exe

  • Size

    1.2MB

  • MD5

    8ff1f72f30a506ecca73786223a6fca7

  • SHA1

    5aaf4dd06c864102edcf0a2c737498f56fc3ce9d

  • SHA256

    c9291b5718b7bd41f312bf6d9cf84edd6c57c49d6b6ed42bffd946724b44f149

  • SHA512

    e4e2792520ba9236d240fb6a244003b8f6132a88a68b13daa0d434ac44e6fccec142d1549d42e88106169ba3dd3bc604cf866e3e6752e3b177f1f6dc780fc458

  • SSDEEP

    12288:FDhdjSCMZeu+fMl2sKHDlas+ivlHDls4CKB8gasHNhUUm5nVIE3RCjutPdWf:FDnjSCYaMBiZauN+Um5nVIEBRl

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2