Extracted

• • Target

    7da29ed5d5ef8e13d8b5631ea4d2868d71721dae0297b260573a877bad180528.exe

  • Size

    1.1MB

  • MD5

    f97182496a9a556473b4dcc2317857d1

  • SHA1

    f856b5282b99c167fe84f4afcbe039da8e68aeeb

  • SHA256

    7da29ed5d5ef8e13d8b5631ea4d2868d71721dae0297b260573a877bad180528

  • SHA512

    20192ef9317c31dfd51c90d7abb63e508b30571fe50f2ed637d5250858686ddb7f5b3187bfb06d7cb2755e2b8c5fdce1d7f5e675c25212bc788e4cae5ee37843

  • SSDEEP

    12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLRy2CCm5joPd6y9gd3iNZvW4k3+mIZa:ffmMv6Ckr7Mny5QL9CCmhvNMZv2O0

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2