Extracted

• • Target

    Purchase Order No. 4500146827.exe

  • Size

    25KB

  • MD5

    cec230139ad2745a9fc15e02c6542e2d

  • SHA1

    a32f05f294ee6ba0e713aa619f63bac3929c0bc8

  • SHA256

    64887897dd3a2b278418cb096f83d7d1bf7ced1c118fef716bd8c6ec4fe91050

  • SHA512

    f88ae9ea244ab2ffbba3069eaeeb9d96b3c91d840999b47eab5e2475a3f6f9aa5d21d3854480716cfd7738ad6f37a69d7f1c2b9a53b05099952322b9cc99bca8

  • SSDEEP

    768:6YTLFV/TIo3J4bqBLW29ydo6fy+tJ1amp:6aLFVRJgu79UoK1amp

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Contacts a large (3999) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2