Extracted

• • Target

    08165999.exe

  • Size

    782KB

  • MD5

    8f0c61518dd4885122c46b7bdf6f069c

  • SHA1

    4a3109be69f405ee1a8f681189b27606ccab1897

  • SHA256

    a1b3717d728edb72724f461a03fb880377d0c3dc9a20b0a8566d3de8db8be286

  • SHA512

    dce83ac81dccc90cf63bca878120fe6f10931674044f06951969ab73ad68be34ac6ff968e60c82129533b066919f0f873faadba569a57b30a4a51992bde25cd0

  • SSDEEP

    12288:9PKcWfPW1nUOMa/E8KC/yKBGTkwbaH2mq0xSK+U+xYj:FWonUZac8KC/yKM3a4OSJXyj

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2