Extracted

• • Target

    6bdd376a0f05f39fb60037fb1add006f9794805981d5aa3295551407bbf33bcb.exe

  • Size

    51KB

  • MD5

    cdea1ac7d7c1be95bd43ccbe4b9f0c94

  • SHA1

    e2d0182c27dd07629e7a2d647241e548c6ceaa2f

  • SHA256

    6bdd376a0f05f39fb60037fb1add006f9794805981d5aa3295551407bbf33bcb

  • SHA512

    b20be933d7a2595d927e803d0d4dc094770b0bf0edbf71b083bdb34e8a05fb9e24ae3951a73f3f8c732c724872625736fc0d307f922d5c90fe867a85b6c78bc2

  • SSDEEP

    768:eLjmX0yEkLNeG5VoYrb6Vz0bjZ/o+CUhdhaj2DF5gcJEJYXfC5/PeBoume6Gbv4t:Ybyn91aEF5jVIHi3CrAbhi7KUtBHZ

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables embedding command execution via IExecuteCommand COM object

  • Detects executables potentially checking for WinJail sandbox window

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2