Extracted

• • Target

    New order.exe

  • Size

    1.1MB

  • MD5

    c7d0e00198c73f896551b993c79ade02

  • SHA1

    9a4d41af0ff29db8e0eca2fe1e999147b2107a41

  • SHA256

    0222c1554ceb01925bccffabe846186b951f8b48a9f1731ed25d51c42761826e

  • SHA512

    058a9571e8fd8a8eaedf451f2666075dff4cca05f42e9b128c0437fea732c2a96fd7df1678e6b854fc8f2b5effaa91b0d9064b1adfa4f07c5deebf1c86e6b488

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLfsP4QECo1pwFg/YMLgoPEEpCgQ:f3v+7/5QLfVQUmG8oPAgQ

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2