Extracted

• • Target
    ORP0987654567000.exe
  • Size 293KB
  • SHA256 c4340dfe60004f2e5274ac4877cab731b01f4b03f708007c6b54e0335fb02b65
  • MD5 1270e1a595a40a6d38cf5534594ea202
  • SHA1 73caae4f89e508930c14ce2df23a16b7498d80f3
  • SHA512 7fb0c9d97bd620bb18ed1f5209e4a62d1fe9aca989476914ef6a1e75513410cba3f6b21a3a8bcebc9fe7872ebb6185da340a7d4b2e05133350138f6d9d8c4940
  • SSDEEP 6144:h8LxBn/GR3JgL+ZD6h2pBkeraRE7pWqDmbjl1FYW0Uq+JXSCeJJ5vNk5:su58+ZDW2pB0EtmdTvo+kJu5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2