Extracted

Extracted

• • Target

    grace.exe

  • Size

    1.1MB

  • MD5

    5d9b61884878c545b2b1eeaa65cc1f9e

  • SHA1

    f8506a932236da131306db729a6089107887e223

  • SHA256

    c21070e515ca67d88bfad101dc8de0aad3215cd230c52c86f67ad9e43013ec20

  • SHA512

    bf06d70aabdc39f482fb255293eddf56bd0d7d446c9b5ace911f59adde87b39c66e76df23c504af5a617dd83c40ca5634d75900055c6568e6464bb9a95a9e59f

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLpSQAMKaeNKoh9rZevIaH:f3v+7/5QLpXAy2KYeHH

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2