Extracted

• • Target

    rRFQ-KTE-16102024.cmd.exe

  • Size

    9KB

  • MD5

    b08b254246c5983af5cfe0518d93dd44

  • SHA1

    2ceddce73d6c3d7db3bf4691df150dfc15506219

  • SHA256

    6c7369db06060c270fb78b99ab9a6bdba2f01c63f1ec658dd49fbcfc320be3b4

  • SHA512

    e7e2ba12ca4dca27c02e205c2bb8e4617f216c1b89686404154386594623e316661b2c322340dc59b2f539bf8bb72cec3756923308639a7f0253de2e10570014

  • SSDEEP

    192:eNHj0XTlm+ePA07Jv+aWa431e5NryYN5JyJ:uHUTQ+697Jv+na43kN2h

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2