Extracted

• • Target

    07aa2b29e42405528a3928069841e33326a2f37b329a256d8c309ec7760fe066.exe

  • Size

    1.2MB

  • MD5

    cb336d89cfc7ce4f810072ee7bc40e6a

  • SHA1

    3b1c9cb0550e636d2fdd462698b68d2a5583e4a2

  • SHA256

    07aa2b29e42405528a3928069841e33326a2f37b329a256d8c309ec7760fe066

  • SHA512

    31af6f68e23f10e64bca40a8289df6fedf269f56cd664a900ffdcccd4d3e44663469f8194a2af0aa9d925f68c61a99c4c6781a361c213d4dfb4bf2ddde040e55

  • SSDEEP

    24576:ztb20pkaCqT5TBWgNQ7aaWqN4SDcGF0Yg6Au:wVg5tQ7aaAt5u

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2