Extracted

• • Target

    e440bcaed6eafaeb5565ea616638a0058b5b77f4817b44a443e502db3bd19db4

  • Size

    1.1MB

  • MD5

    c8e19725e72ec02943ba86823b5586c3

  • SHA1

    b11d7522cf1b5cd56819bbc15368d39326a5ef0b

  • SHA256

    e440bcaed6eafaeb5565ea616638a0058b5b77f4817b44a443e502db3bd19db4

  • SHA512

    99241e66e9f12958424a846edf85f92acafea7fc04188492ebe9590f182923b728bf40edefae824a9b6c149599fa59aa73d5d7fe6b8ceaaca94a221fce682ac8

  • SSDEEP

    24576:OqDEvCTbMWu7rQYlBQcBiT6rprG8alCOzcPLbd9:OTvC/MTQYxsWR7alCHb

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2