Extracted

• • Target

    ANALYSE_.EXE

  • Size

    306KB

  • MD5

    cdd187b140f787efa951fab18d274cfc

  • SHA1

    04dd7b20c6ed955f23a745b18a6cf3ffdd1a6f94

  • SHA256

    b3a1509f77da1f09f79e2d0d6b6c6938db01f8ec67fa6adcf992eeb5b6b8698a

  • SHA512

    1248e398a051f9a5f4ded802a34e84a3fb57c17a83ff8973498dfc28b6497834b426ef80d4ac5873bb3ae063ca176c594de3276568745678269ac049fd8a5cea

  • SSDEEP

    6144:ux4vyP05yb7EuugWVZ+oYZ4X8Ivo2K+9OzYoAG94FGiVU1xiZc0I/sO:Y4dcTbsYoYZ4X8IvoL+9OzYoAG94gW2f

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2