Extracted

• • Target

    3812e81146eed8bd3c8f0c471fc5c67a82a40f452a7c824a75df89345b38fcf8.exe

  • Size

    71.0MB

  • MD5

    0cb101284fed5ab4fbc17293874f92aa

  • SHA1

    a110a0bac9c2d151f4ae9928b86159ae1f810e07

  • SHA256

    3812e81146eed8bd3c8f0c471fc5c67a82a40f452a7c824a75df89345b38fcf8

  • SHA512

    1b039d5abf927a91c7c0e8b9d5611dfe278a5e5eee6f34ee0f71362a87f45a2f6da1c7040b4d1c16962cb5f0d681bed2d922c38c42c9bd61dfbfa53978a29994

  • SSDEEP

    24576:Gu6J33O0c+JY5UZ+XC0kGso6FaPay6znXdjDWY:Iu0c++OCvkGs9FaPa1zAY

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2