Extracted

• • Target

    1245abbcbbd602f1822156476a2c385760e3ddfbd8c38e647e6bc8c7c556dff6

  • Size

    604KB

  • MD5

    629f1656453d160362b2dba89bdb8a14

  • SHA1

    3b301d3d4f17f9406efdd2bcf4101f0bb6231a8b

  • SHA256

    1245abbcbbd602f1822156476a2c385760e3ddfbd8c38e647e6bc8c7c556dff6

  • SHA512

    89ff2e091c2139ac44bbb85a8832defd372d8d7a7cbc9749d857448a82fd956168ade71bcb5386bfaa31427af995749c16343f6a1151dbdb0aed90e2e9445eb5

  • SSDEEP

    12288:+YV6MorX7qzuC3QHO9FQVHPF51jgcnHhkibbKDyNGwLa4k:dBXu9HGaVHnBXqU7Wv

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2