Extracted

• • Target

    097c7472803e5dca675ac074c1092848ae92cb468447eb8d0b57afe392c156ad.exe

  • Size

    1.1MB

  • MD5

    3a60ee2ac533387925bc447e17710bf5

  • SHA1

    2c6bc2839eaca6f3dbe43568940a7dff2b1ea902

  • SHA256

    097c7472803e5dca675ac074c1092848ae92cb468447eb8d0b57afe392c156ad

  • SHA512

    6ed90eb31c4dd83e408bcca99db9313a6d465af2e909b873549c526cfe776574a5d1861a05ef7666dec998db069030f84d1cce26a9648c3103b9ded15b2a2661

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QL1jCfcqTVfA7JE9k2u7acVa:f3v+7/5QL1j6TVfA7+9juacVa

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2