Extracted

Extracted

• • Target

    PO 66860012.exe

  • Size

    643KB

  • MD5

    9e56448adddd5f96b3c230ef88cace0d

  • SHA1

    29402ee228a33536e922ab41beb25557e38dd162

  • SHA256

    6378ee5937b33326a40e1545b4cfefba36284469426e73692172c2497b286842

  • SHA512

    ddc4ec84faae0081c59af915285e4d8e2812fca023d0f987a613e2109937a2a204509753e37d8ca26ca23644c9b8f4c7cb5514d8d7d4a7b2a300182214f1dc3b

  • SSDEEP

    12288:y1CSfMlEx7w7i9MX3TFx478mE4DjmgJru310RvtEEH6AZJhDemI4TpMjn9ay:CfMlEx87i6HU7894DfSldEaAJDemIi6n

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2