Extracted

• • Target

    d94771673d1423312105db073fd108e8659ea22c7fabcf413ca9a1c1ab5c216b.exe

  • Size

    767KB

  • MD5

    94abcf2c59911509b172e3428cdce7f2

  • SHA1

    3baefd7eddcaf14c11579c78ebb31fbb14952ee2

  • SHA256

    d94771673d1423312105db073fd108e8659ea22c7fabcf413ca9a1c1ab5c216b

  • SHA512

    eeb92f45d3dfc813154b1deabf2a620bcefff2ef8afa91ea8f11255868a71b5bc3eb4723a766f041cf2e046774a0e92f4f71f6187788c96a7030b58c01955a84

  • SSDEEP

    12288:v6Wq4aaE6KwyF5L0Y2D1PqLtOH+RvpHKcSuehU/sQHa69XDYM6pmqW:tthEVaPqLtOspqcSrfQ6AXDYpgt

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2