Extracted

• • Target
    519ca17094fb9a2c019ca09f37ffd31cc2175456597c7abb642b7b66db6d0419
  • Size 25KB
  • SHA256 519ca17094fb9a2c019ca09f37ffd31cc2175456597c7abb642b7b66db6d0419
  • MD5 f72600d8c26ae084aee6d956fbadac00
  • SHA1 7a7e3a1d59c7446a2443592cb1d3435415350f62
  • SHA512 c0edf7b188cf812e855caeb8a67407c4f33914b1822bc9ddf761fdea711e9a380d0d6523c2f2aa2dae7ed5ac3614a711835926b68a690929a5a9048504917848
  • SSDEEP 384:gIe083yUpvZ+QxZWgn3xNBz2WjMYwHUT0szzjw/LCDoRtv1MUOIZXW2F1vkcgxxX:S0wvsQvF9ZUZKUWodMUOIFV1vkxyT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Contacts a large (4050) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables packed with or use KoiVM

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2