Extracted

• • Target

    7d658e7d4fdce9ab237617fd28b784e73110be0bf9cfdeeabab1e897b9ae2c10.exe

  • Size

    530KB

  • MD5

    7d411a34136e88e95d155a5cad1fdb5a

  • SHA1

    9873390cb988aa07add91730944d717f4df32c68

  • SHA256

    7d658e7d4fdce9ab237617fd28b784e73110be0bf9cfdeeabab1e897b9ae2c10

  • SHA512

    3371b0fb4cd0332d3476f7083735552620179788091444c8f4cb17a03ee298b803d826ffa4b2383cbddf4b75a20570cc377210e427734e5c60b9c63ea686c8c6

  • SSDEEP

    12288:W3dPSj0k1KImtsjw/oB/Y6kjjWgTg27K57ZszDXTVBC5/q:W3ddWjcofTg82Es3TzC5i

  Score

  10^/10

  discoveryexecutionagentteslacredential_accesskeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2