Extracted

Extracted

• • Target

    198ad08263da7ea050003bb7c98d9d4ec0951da98432f3ef2ed1f2cf208b8aab.exe

  • Size

    51KB

  • MD5

    44ef67d36591a9919537dcb1b3eab620

  • SHA1

    516207d3cad0715fcb2b97d972273529861a5620

  • SHA256

    198ad08263da7ea050003bb7c98d9d4ec0951da98432f3ef2ed1f2cf208b8aab

  • SHA512

    9642d0a069e55c722d48a768672772a484b52c1e7c7fe4e3df41d4fe8d3b172de3b35e7a195f527ed3bbf511c2d38f1e4593ec4c470270da661879792e5fa26a

  • SSDEEP

    1536:m9GoybjmKenUVriynW539+E//2djZEQbh+5tjO1:m9GxqnmeyS39+Y/YEQbh+5JO1

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables containing artifacts associated with disabling Widnows Defender

  • Detects executables embedding command execution via IExecuteCommand COM object

  • Detects executables potentially checking for WinJail sandbox window

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2