Extracted

• • Target

    a30ad0cf60c1527b848ded00c2c6bea0N.exe

  • Size

    553KB

  • MD5

    a30ad0cf60c1527b848ded00c2c6bea0

  • SHA1

    344aed764300eb67fb6ea658442714700b228653

  • SHA256

    d6bb535225fe3c65b332388ee1ddfc2487160ffeaa6fb55a88091ce72e16a536

  • SHA512

    45a0c4e86dfeb6554550a4cf6106ecba8b1f6108c4fee79929ee3131b70c34cfa2f01a66252faf9c5b99386e3a5e8e8c2ca608e7e32c74382984b3977c83c880

  • SSDEEP

    12288:VYV6MorX7qzuC3QHO9FQVHPF51jgc3t5Zd1WaDFVnt:KBXu9HGaVH3bs+vt

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2