Extracted

• • Target

    115a0abcf8bfe4d0320ecc08c9f0668f35dd796b7a74c6dfeb9d6fc7dc16d214.exe

  • Size

    559KB

  • MD5

    c71017c92f23cf51da20b714ad495401

  • SHA1

    c7f43bb30678e506be3c0b53f7751cd38fd3362c

  • SHA256

    115a0abcf8bfe4d0320ecc08c9f0668f35dd796b7a74c6dfeb9d6fc7dc16d214

  • SHA512

    f246f55c364d75061ef2276073dc8cb57b8f937e24730aad25dd9952169181174522939becc8471442403735b56007852782b1b25ac1c80482dcdad6439a012b

  • SSDEEP

    12288:rYV6MorX7qzuC3QHO9FQVHPF51jgcHjseTsWRtEFQFu1yArcLNy:IBXu9HGaVHD3rRbA1yArmy

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2