Extracted

• • Target

    243bc636945e02bbc83d97b18889934160a2cd62af3771f5dc1762ce8882a32dN

  • Size

    1.3MB

  • MD5

    fb8a9073816a16acfb1c4a72800981d0

  • SHA1

    e65c672faf27e76d80e83d687a38c7587463844e

  • SHA256

    243bc636945e02bbc83d97b18889934160a2cd62af3771f5dc1762ce8882a32d

  • SHA512

    a6510e20a6754880aa2c3c9128bd81c13dc502aa53cc047013817b7196aa8fdba0adcf40689b526eb1cc7c2cb975c2d6f345318dea7175233194df9277383aea

  • SSDEEP

    24576:sJjVxuVDI0WJiLnVShrApgS7X/ipybXbMDGis7ZKbKoY14Tvr8ewOmqSwIA:Aj2Z3VwcpiiMD3qXoY1gvrsOmN

  Score

  10^/10

  discoverypersistenceagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2