Extracted

• • Target

    7066dbf6670704e8c1488d1b4ba63a75c239dc99cb7701a2bdd1154cd330521c.exe

  • Size

    1.2MB

  • MD5

    d5da713109a719c683f929d77d3ba737

  • SHA1

    fdedc2eefe3a6b476c9036065064d4cdface2dd1

  • SHA256

    7066dbf6670704e8c1488d1b4ba63a75c239dc99cb7701a2bdd1154cd330521c

  • SHA512

    e631683ba4c269fb8100c6228f2d0fcf95db0a4054b059fdfaec297f2f9aaeaeb4d1bb03e8443ce3cc8019ae6a4826a31683d3bae47f66472bc7dbb215711ea5

  • SSDEEP

    24576:0GAgghMQxYV4XixhJLFBwfvsEAykQBuUU6qfYrXCD:5AgXQ2WUJL0vsEZ1g

  Score

  10^/10

  discoverypersistenceagentteslacredential_accesskeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2