Extracted

• • Target

    9b9a0c891f1bb5b3f92adb328413b54c20f6d9c227662510f6cc4058ee771c30

  • Size

    1.2MB

  • MD5

    3e844cd6a047a0f889a1d2b79a689b69

  • SHA1

    f6720c346b171913868c77508d95d440076de361

  • SHA256

    9b9a0c891f1bb5b3f92adb328413b54c20f6d9c227662510f6cc4058ee771c30

  • SHA512

    9cbbf269d1fc0707f5fd542f224ee02805a5fe07090dc602ffb008468c0aa8f9e56a016275300f7bec7736a20636bd210fd9bb6f1d05329f3279bb0307946104

  • SSDEEP

    24576:ztb20pkaCqT5TBWgNQ7aaWqN4SDcGF0Yg6Aq:wVg5tQ7aaAt5q

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2