Extracted

• • Target

    193cd85dbdd5cab748839284a4c2396f4db7fa366ad5c55718de2b742cda59dd.exe

  • Size

    1.2MB

  • MD5

    0e4fd4b092e0d72115cee4f57c213e40

  • SHA1

    9a51a95fcd769a34858ca632a457cd88a3cf2c78

  • SHA256

    193cd85dbdd5cab748839284a4c2396f4db7fa366ad5c55718de2b742cda59dd

  • SHA512

    1b115795498f43e358dae28f764f7be294192eb1899d05aba8cfbf0e92e3504e7973c0d8cc7873fb4a7641230c4cb27da686d62655b98d61c04fe4a7cd1738ff

  • SSDEEP

    24576:WfmMv6Ckr7Mny5Q6AavJmwv3e/UnHg/PzJTKOk74jrgVRb:W3v+7/5Q6Aaxm+jEJTO74jrgLb

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2