Extracted

• • Target

    PurchaseOrder.exe

  • Size

    1.1MB

  • MD5

    231e4c689b7b4a7b7ddd4aa4cefb8c25

  • SHA1

    b0dc66891fdf5dd51524a9dd8a1272f34830d851

  • SHA256

    5f9a7f6a183b3966e84173f3ea7fec1ed563e9cd08577d87d523d9f69f66eb8d

  • SHA512

    6e3999f67085b1b5ef2600f4e041eaaa138e087e7d140d7e6e27b97e8915cfd8b131a136f708c67837ad430c51535f9b9c769b9acca4c300a93cd54048235131

  • SSDEEP

    12288:ULkcoxg7v3qnC11ErwIhh0F4qwUgUny5QNrJqBgqbMADUCBEX0t+rYHWlcuoyFhv:KfmMv6Ckr7Mny5QtYSbJCiXeVZiGPxE

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2