Extracted

Extracted

• • Target

    5fc47ca65df767fcb09cc074dff3d5d02ab6c61ffff00b409ea2fa4107e080ce.exe

  • Size

    1.1MB

  • MD5

    0d14cd85f7729e2b3c4c8c5247ac3df4

  • SHA1

    c6f99226a3728bf9d0eb53e98538b98e8504bc7f

  • SHA256

    5fc47ca65df767fcb09cc074dff3d5d02ab6c61ffff00b409ea2fa4107e080ce

  • SHA512

    8c281c891ba5763b0f2b148ebc85d9e73f00e0d71b4aa1dda7507719480b9f00833ed7edb84f32b2d1af38058ba544b6a0f37d2843d9cf821429362fb43e6985

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLZ7sI/17wNfepLueaB:f3v+7/5QLZhU2pLIB

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2