Extracted

• • Target

    3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe

  • Size

    1.1MB

  • MD5

    ec066ae04c36cf907aafa4448b614467

  • SHA1

    b53d01c464f61e4654286e8650bb171be14902cf

  • SHA256

    3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb

  • SHA512

    b30f55db38a1c4297c50d3d7e87748ee7f5d203a002d58a61d5770394bc39a7c1b46b50fa094282eb21330830ea7fa523e3eb5c0ac7f1229ded244c8a3e4529f

  • SSDEEP

    24576:gqDEvCTbMWu7rQYlBQcBiT6rprG8ap3H+1PNrT:gTvC/MTQYxsWR7aZe1PNr

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2