Extracted

• • Target

    5b74f7218a99d18bb1961ccab95e2d8c0f07bc62499b32f8962587b953b7c32b.exe

  • Size

    645KB

  • MD5

    c05ec2b49ef0eca110f46b3cd6c6bc9c

  • SHA1

    b576618b370fcdd50686873430ae672aeeec981c

  • SHA256

    5b74f7218a99d18bb1961ccab95e2d8c0f07bc62499b32f8962587b953b7c32b

  • SHA512

    ddb547298322ab7dbca8265f8f376467e12327300ff6cb9c666910dfc8abee690c3f4b428aeffa1a3ad9f209fe52119e482d65d93d9ba377e8f4bb5980dcb61a

  • SSDEEP

    12288:b+8XG5SFEyclCv8epb+k/35QM9pn3yK/ASiTZTES9+aTyDQTyx:b+8BFslS8ep4M9Z3yK/A1TZASwaTkQTu

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2