Extracted

• • Target

    WHHhH.exe

  • Size

    257KB

  • MD5

    7d182b70df902cd3e6c37007cf5737ce

  • SHA1

    32603f9b910029a64f0b48da8efa6f828e533e09

  • SHA256

    36fd372d229b27617570472bcec54b9b401d5db154370d4fd1643786b18c9b73

  • SHA512

    4db672c60337fa62f4f5a780c573d2bdcad424f0fa31189d6a8874549c73aefcb280217351d9333d68a243c49c90ffc2178d22057da9459a66db6617ab661376

  • SSDEEP

    6144:jYS+Kp81eoK+afzzrSZn+EP4bvD6NjdF5KMRoWjmF:jYSO8oAfjSebvD6Njblq

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1