Extracted

• • Target

    9f40759902174555ab1294eb92ae2d17ad2698d2e0e68694edbb9684bdab7692.exe

  • Size

    1.0MB

  • MD5

    94c700b33fb2a1aa2bd02f13750cca75

  • SHA1

    abe3abd4f60778dfa694a8fc54b9d1037a248132

  • SHA256

    9f40759902174555ab1294eb92ae2d17ad2698d2e0e68694edbb9684bdab7692

  • SHA512

    b1962793a313490385ce265763a05585abf1793336ffbbb853fc64b6807e35ec98b28daebe147f98bb901a804ce88bc930c33b7938f31b51b9c9a0c258decc5a

  • SSDEEP

    12288:5faWYFsj2FYoIAyPn4/SLfP2Udh1rtZJi3l/zSL6WKuwpbt+jBL/nepC:ldeXi4/42Up5KV/zSOWlabAjNnKC

  Score

  10^/10

  discoveryexecutionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Blocklisted process makes network request

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    7KB

  • MD5

    5d63878da0cda0b331e80e43e3d3c2fa

  • SHA1

    749b02a5bceb2d1f8a912dfaf40fe8c3b082bf58

  • SHA256

    21eb98aa735fc4b4072e670a78f1e5802b3d3c950bef72e32f573dd514ac7f18

  • SHA512

    240ccbd96bbf5d4608778b91ab14b73b20771fff3763e8df04a9df83f5371d4ada64b5b6cc262626927ee1c13fc0d98bfaaa0332786c0af588a4c24924575ed1

  • SSDEEP

    96:re5Vl/7KOuFlKHMpXGu8FX6eT3sQk1u2QmIGvebAQvL7hDAbUlV:65Vl+hSs2u85TTHkZQmubLL7hDMo

  Score

  3^/10

  discovery
  behavioral3behavioral4