Extracted

• • Target
    f17b71582e6bcd27cb480ed09318139aae8a42ba99bd2dd89fb879cbd99ef4e9.exe
  • Size 1.0MB
  • SHA256 f17b71582e6bcd27cb480ed09318139aae8a42ba99bd2dd89fb879cbd99ef4e9
  • MD5 cd70512213b5f4679d11615509b17f2e
  • SHA1 4de3ad8b37e013f1735f2c309bd116b382d0024a
  • SHA512 17475d219acb1ac683da7689b8f2a98390f13962b5dc2b6bba4bdc8f407fa53159ed38f0d94cc9b5e57ac092156a7d466b44fe6f1e59c49953eb51af06bdca21
  • SSDEEP 24576:WAHnh+eWsN3skA4RV1Hom2KXMmHaEhTAMfXYA6U5:xh+ZkldoPK8YaEh8MBV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2