Extracted

• • Target

    9f3b919ce19ec77455cf976bca1489292959e2032e7498c3daa6099b2ea90d8c.exe

  • Size

    495KB

  • MD5

    d6ff66eeba266a3eda5af0c40d6a5deb

  • SHA1

    ebcb218d12b52e4567046e7c73bfba896b1fa09a

  • SHA256

    9f3b919ce19ec77455cf976bca1489292959e2032e7498c3daa6099b2ea90d8c

  • SHA512

    3b87e4dc73ec79253361da82a531fd7da75e23afae7792e31e7b014339994d30d91372d6795f692e5e6e5256ca51204c87af1938533fddba596eb814c68f87c9

  • SSDEEP

    12288:IIFypJoDAP2wEve+g3c9kP9/kVTtFwP0nRUw:DMpqAP2Nve+g3cheP0Ww

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2