Extracted

• • Target

    02d213222d449d131b14fc3ca8296bab9119c12d4241c0fa25c05450a99a73de

  • Size

    1.1MB

  • MD5

    671cad624a5908f399982e1e02210bfd

  • SHA1

    148d1ce13eb8ae14f8358a4c8f08acf99aab6f54

  • SHA256

    02d213222d449d131b14fc3ca8296bab9119c12d4241c0fa25c05450a99a73de

  • SHA512

    f1394bfbcb4b172cda2aedfb6a1f5c652ad176ea05a4b42ef0fa91354dd71b786e3fa92fd2e8a9793c437c851865635d927a562677934e3261c792cd0b2baf80

  • SSDEEP

    12288:2CdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgaFTPVaukkIg:2Cdxte/80jYLT3U1jfsWaxPVp4a7EQ

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2