Extracted

• • Target

    24d05bf49b9f7d508c8cc3c2cbf24d77d3f71d9a15879341f8a01a4a36cb2bf2N

  • Size

    1.1MB

  • MD5

    8b516c8d81bb15caba4fc77de20f6e60

  • SHA1

    622dc254dedebbe04315123fb477beb815618033

  • SHA256

    24d05bf49b9f7d508c8cc3c2cbf24d77d3f71d9a15879341f8a01a4a36cb2bf2

  • SHA512

    668458d9d5fb25e15c8d81b81488c6416edd4320f1695a4e0dbc19b725fbf6787dcaff2f9fb07fd3d16053e37e82ff8f620600328ee820b7948cede84d308bd6

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLwkDamHi9iJwO9+CTZqr4dE3:f3v+7/5QLwkDamHi9Mwj4o4dE3

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2