Extracted

• • Target

    dac255fda42f32a0a05db94c4c1631935a37e594ed4832076702aa8af3c17630.exe

  • Size

    648KB

  • MD5

    b41ae11d249aa85fe77c742ee8a6e1a1

  • SHA1

    b9a78d2655c0d5a143d0d26d0d2df0d26891dc94

  • SHA256

    dac255fda42f32a0a05db94c4c1631935a37e594ed4832076702aa8af3c17630

  • SHA512

    d4167cb6586b58fcac3d8ab9ce00a8b79c56b5e16d4c592ec6153dd1ba6507096ef8e1731e5da7292456823d5cdb94ac9936f81442ce45b8ca15ee9411a671ec

  • SSDEEP

    12288:b+8XG5SFEyclCv8epRHnOM3rkv9SE8vtbftH6BjFltCIQrrbfds9zkF:b+8BFslS8epRHnOM3ovp8vtrJ6vjCbfZ

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2