Extracted

• • Target

    7cfd9f48da9d60e61380a3bf7b4bdde5a03817a7d95bfd9f84c228a2e313fab8.exe

  • Size

    2.6MB

  • MD5

    98e00105d9bdeb0c10a0987cb657b0b9

  • SHA1

    f5cb6141dc4eafa33aa03c5a2e2a9dd19af576b0

  • SHA256

    7cfd9f48da9d60e61380a3bf7b4bdde5a03817a7d95bfd9f84c228a2e313fab8

  • SHA512

    a7c27c4fc8b8a81d94172ae7199c42b7e6137f8e7c4cc7396042e927c35e47f65564968cc951a011ec9e5b73def8f622ed59d8f978ef973962ff579adcf56e1c

  • SSDEEP

    6144:6lEwrBTf7qi2dFXtYpJqCZ+Ub5nJnYa8kWZc3m9tJLK5E2XlXszMBug7Osngx2qY:ZSdtUFXtiP8oZUq7Gtg7vnml6

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2