Extracted

• • Target

    81604561456777c82c2b10e9ad4a3453

  • Size

    568KB

  • MD5

    81604561456777c82c2b10e9ad4a3453

  • SHA1

    b0172e65a04f431b506d76d1b8313b3a3acf4685

  • SHA256

    b5485fb8ae30912b3dc62020db2dedde56c1187e40db299ac99060aad2f1a9b3

  • SHA512

    2480626a40d918fb828f8913ebaab7425118b500bb23c152ec0edb80b92054c374437fccac9f2ffc03a021e5e83cb7f8ab9afb92e80900d2fd7bfa5efeb7539d

  • SSDEEP

    12288:7Xe9PPlowWX0t6mOQwg1Qd15CcYk0We1Fwwvg5ojS/5u8B8fIfDjs:ChloDX0XOf4wN5ojS/Lc

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2