Extracted

Extracted

• • Target

    SecuriteInfo.com.Trojan.GenericKD.65594079.25944.10510.exe

  • Size

    1.5MB

  • MD5

    ee0a61b47e6676cce5c6908cfe8d9f98

  • SHA1

    a7636fc89e3e076b1e8bdc2fa7b3ae3f7ba126c2

  • SHA256

    be1e625483202184962d61f45c1c31c00a18063376a91ce7bae5ed72169d05f2

  • SHA512

    cc644964da0fa26bcdfc5d92aedb6527e098fd19bbb40308df6c16b5df9aebbd5f463a59285a19081915d08dbedeedf90adda0ebcf59902ec8117777cdf2ff72

  • SSDEEP

    24576:zU3iOHs23wM460Q9kB1dExumukxUhj4oEjqFzqMAxHbQaHhizTM8T6H:A3K8wVWe0NUhkoEjqFztAxhN46H

  Score

  10^/10

  agentteslarhadamanthyscollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect rhadamanthys stealer shellcode

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2