Extracted

• • Target

    Tordenbygen72.exe

  • Size

    628KB

  • MD5

    ac85335afe1237e78ba86beb2950c3bc

  • SHA1

    7ecdd418b3a15a858f86776969da3a3b0e04f9dc

  • SHA256

    09606aab0e4d6b1ad408da37e0245df53c5769960e8f1aca6e12b6ab979ed4c9

  • SHA512

    8e5042b331c60808ac6c4cc79f888eceb35478a06cd89de8977a7c83282861eaacb2adcd70e0431a1525bb8edd68918b056cd6099569d42be13c86d09783c615

  • SSDEEP

    12288:1rAEtSq41AlJzRM+hAxPa3lRgG6xZxzyVLehCFBAx:1rAEYq4WfdMLNa1U/zy1ehCvA

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2