Extracted

• • Target
    5e86cc7463e90fb10d4c7f10858869e96ea3c50aca9f61dd50eeb5fd629da053.exe
  • Size 635KB
  • SHA256 5e86cc7463e90fb10d4c7f10858869e96ea3c50aca9f61dd50eeb5fd629da053
  • MD5 6858ff69d90d9e5cae22ec22dd31cd19
  • SHA1 cd8f078c4e652e97d3b446d2c36bf3e7ce524bbe
  • SHA512 865059d47f0bb366f5aade1a266a8f1c0f555184b595b7275bea0b6e85b6b0f539e60a508f6931d2587f480c674629b80b96f5fa9a40e51dd6bceb2a56092178
  • SSDEEP 12288:ZW3+mA9KIp6SiUvtPQ18mh73F/CvLr5jNIMzsW+ZZFCaEPbk5MYvs:ZWbA9rphvaVh4vhNROZyjHYvs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables packed with or use KoiVM

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2