Extracted

• • Target

    COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe

  • Size

    1.1MB

  • MD5

    7b29104168610875dc525f1939c1be9d

  • SHA1

    a35013b158fae14b83e1596098a032f70114d0df

  • SHA256

    f04633dabb4fbf66d38cc86181f7770d44910073d4866acd15ae29f96edf4863

  • SHA512

    bd13dc4b52f4c612ce8b07971952156bae9631f47d82cc3e619ca37bbdfbe89489fab78855437926b3c233c92b11cf9bc7f39a4d81ea030d801aec6f637d063c

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCPl+2KvjAwpNksq2JH28O4:7JZoQrbTFZY1iaCPl+2Qj7Nk9h89

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2