Extracted

• • Target

    PO#23085.exe

  • Size

    893KB

  • MD5

    4c491eb25d70911a6d26c3f51523da79

  • SHA1

    268dc742854357a81c567b20d1554920a23d3239

  • SHA256

    526e419ccd5c187f23892752d36e79a60344def92b736f9c583429b6fb817f9e

  • SHA512

    4fa87a61290ae3aed06fea001bf249b3e609f8491bead5f8f7fda43ac9b0bd76ec6d226dbd43770ceb574ca68e2a4208cc420e914dbe8e9e2923ae0637a6695c

  • SSDEEP

    24576:RHvFFMaiHSTm6ijgrWavKGXgxBJrTYn4iT/5U:hvFFDiHSTm6ijgrWYXg6BhU

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2