Extracted

• • Target

    junta justificante.exe

  • Size

    357KB

  • MD5

    e40b02f52316d85f32ed05c34f100a9a

  • SHA1

    9d90e3bc34698ea7cd32a1e01fa5bc36e83a62d3

  • SHA256

    dd8aae27e7726cc2fa28a115919e94014d94b8300018c97fc06448f8fea2796c

  • SHA512

    06b7368eb9a0da553cc386c2cfd655c969482da45ed62d43ed8c1ff79e9de65b0e150220fc6f11767f71e1d6336de466c3b5c4267bf1d212d04efc1a74c3131b

  • SSDEEP

    6144:bNDlOltlhX8OMB7p7sKBWgVEfaq3Az8wG8dZIu8I0bCy1Fx0iOk9+RLWps:but7JMT7s4WgEfav8wG8XfD0ey1F6bky

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2