Extracted

• • Target

    transferencia_swift_0986986854735465768798076756685469.exe

  • Size

    1.0MB

  • MD5

    0dd81b6a2e218605b8f36599a04e10b3

  • SHA1

    c7efe38002a5a00521c8111d8726c9e8a61fc7f0

  • SHA256

    76c66540cbc5e2cd1a5fb92a0c1c4eeae6fd59f28bd9d11d8504e321d2a9b07a

  • SHA512

    91a7017ca7e2ec6a2dc72b55ca500d8576e0c0503d717855b317a2e356f675275a0f203af2ef98c94d691386d0fcf327cc2ce01bc8525909cda8d2269839809a

  • SSDEEP

    24576:Ntb20pkaCqT5TBWgNQ7aJU2psUAqlDJ7+nt6A:+Vg5tQ7aJUHxGDst5

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2