Extracted

• • Target

    SOLICITUD DE PAGO.exe

  • Size

    804KB

  • MD5

    eca6e5d1b6da0957d7a179605977c7f3

  • SHA1

    f3d3cdc9b1ac8bdfd092e718c264cb291e73f99e

  • SHA256

    b4337365f4919ca5330d2da47e51e60f343f0aef026410790a94e30f289cea0e

  • SHA512

    9150f1f1dbc635317390bd9503928247c0ab75df66cb00a41061daae4e8ca40f00e2dc85c0cd6bb9bb65172077b57cc078e81ba2b2f177ad45e18a73bafc6c86

  • SSDEEP

    24576:jq5TfcdHj4fmbvl2B16spQwmi4t154I+1xlS:jUTsambzcn4Lm1xl

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2