Extracted

Extracted

• • Target

    PO NO.0200058.exe

  • Size

    912KB

  • MD5

    de68b61ea9b8086259280b19f27ede5c

  • SHA1

    b9cd5e9f2c6a936361bb48d04d61a595d83d71af

  • SHA256

    c86de3e77ae95280bae0e6ba2c1248bb30760b972f4e39993446be343d4a3808

  • SHA512

    6a612b8c208e1408aeac0f9b801ce7b452c97aefeeccf308a94e07aac3f20129a5e10507d88fdab4ac843a7823f7906296800e763bea404048f94a801b38102d

  • SSDEEP

    24576:nyr9a8gJ2wgF7EVGBOPTqUqtLRTZoO/rAfWMyQqph:w9a8gclUAOP+L9RV5/rAfWMAph

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2