Extracted

• • Target

    DATASHEET.exe

  • Size

    464KB

  • MD5

    07125fc15f7a109f6a067d38257faa94

  • SHA1

    c196c27cd72a380dc5d4864831320f9d00078d73

  • SHA256

    f72267ce7456d977ff81981b8704a697b2198263570203f394c5a306705d8a70

  • SHA512

    d5d0ac6bb5e0f09e0b55fe505eb0e8f407408154ba604894cf57a3da07779f5b63f202ec92ce45bf59c9454daa9315ec51657b3db01d0b16c79dc42377ef747b

  • SSDEEP

    12288:Jew3A2c3JXZvSJZzQ3pXJYbfTvrsYtwQEAE:Jeww2CYQ3pX+rTvriAE

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2