Extracted

• • Target
    Nr.21784795 Technische Dokumentation.exe
  • Size 457KB
  • SHA256 60cb144c7f4433013b373b1ca8704cee48c8f1e8417a4ca520e2386e4d3ea8cd
  • MD5 518261f6bedf83ce87814867922a7cf1
  • SHA1 bb65498ca3a838a2755e9ab93047656688749b63
  • SHA512 6a35fc4622b4d2444da6cdbed61832fd53f0d9277120e263a1a4b78e7dfe7e346fc412f098da6aa0f2929d1f076fc2d2250da6efa3883769cadaaf33f2784e9d
  • SSDEEP 6144:jQLFhJEW1XX8fKDq38j5T+FtWnfR7cs7N4k4rSx9KNHUEY7yzxRKtm0NOrqEhugz:0FzEaX8f+qsytMcs7atA9CA28PF5o
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2