Extracted

• • Target

    5d9dce7d1198a20164989f00b848f9bfd81a0447aeda93af5541615ef56e9600

  • Size

    1.1MB

  • MD5

    43891a104f8ee833cfa9e81915276d49

  • SHA1

    27be5c331e1dddb4d3d0dc751fab3ca4c074a063

  • SHA256

    5d9dce7d1198a20164989f00b848f9bfd81a0447aeda93af5541615ef56e9600

  • SHA512

    af7c71c318e2bb7d43a75a9de15a7b358a7e8f5883db5d0eb5c0a4ce2a2248cba70567874c350f67b1e17990cf3ad1396781113f817af99f210d972f79ed1405

  • SSDEEP

    24576:bu6J33O0c+JY5UZ+XC0kGso6FaAB9lTv/H/clNQImWY:Vu0c++OCvkGs9FaAB9pv/fWQUY

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2