Extracted

• • Target

    shipping.exe

  • Size

    1.1MB

  • MD5

    f3ecc3f5d66720700cd7927178efbd16

  • SHA1

    38a8dc60faad60da61b5787d29ece4bcded6f7c7

  • SHA256

    4c2de5043cb67a6805824b096a6640ab47b60c0c1ed71a452d3228144c92b0f3

  • SHA512

    ceee13504567a4082dddce8237a6ac9cf070cda8bbb6bc83e2fa482560c2b29f9663c606144da9bfa3f6364ad208e18ef45bb35c21fb4c6543a66cf95ea4c1bf

  • SSDEEP

    12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QL0GFUT5Dn5okl79XRmUl9XwiwpGb/Gy:ffmMv6Ckr7Mny5QL0YU1DnlRJ3XQy

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2