Extracted

• • Target

    Documents.exe

  • Size

    1.1MB

  • MD5

    10e88aa57f10e0a3d7ac679156cdf11e

  • SHA1

    66d7694bbdbed1a836feb160ebed7d647d3d45e2

  • SHA256

    cb9790cad0a60c5d06786c99700a84a880c04abf6477ab97453b13ba386306f4

  • SHA512

    4c4265386fc8a7e04bcf776d8f16988da807de085f9aa4cee9477fe3f618d98051c5db918107964de6af9baa2a6b8f7f2de27ca5ece3db62a1ea6b08bb5d12e0

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QL5AZrIdN0SUCPbWLfN:f3v+7/5QL5gxCPIN

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2