Extracted

• • Target

    9e19f6b4011cfb241e826abc5e52b9e2c5b99966a661ab548b90691b06cb3900.exe

  • Size

    707KB

  • MD5

    6a8021f8078119a8c7c55396b3db595b

  • SHA1

    969ef2f9d7a2c9574506d549a52965f473ca1bb6

  • SHA256

    9e19f6b4011cfb241e826abc5e52b9e2c5b99966a661ab548b90691b06cb3900

  • SHA512

    cf44779730c75567453ec254dd04a35f0157e13a9d1226f6b338e512b471b5a41792f5a63071999c3c6b66a7aedd8f1ffb75d68fbde9a58d18709f5ee1565a9e

  • SSDEEP

    12288:IOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiEgOkEQ0CIKDt3TQuQaBD0:Iq5TfcdHj4fmbadHIStDJ+

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2