Extracted

• • Target

    996d886a06da35cd8dfbb28dbfbadc88644e70b52f99b5e4e16f7ed8dbed56e4

  • Size

    1.1MB

  • MD5

    d09e7d31fbae54ebee8236c658f636f8

  • SHA1

    517f41018193311b97449d2d9d7f9be85338a365

  • SHA256

    996d886a06da35cd8dfbb28dbfbadc88644e70b52f99b5e4e16f7ed8dbed56e4

  • SHA512

    5860bfa2e3158f3b49f61a4dd80bf5407a1a4876e3d2447bad1d529e52814f22dc409b4949bac429f3ca1e32d2f189a37f4d60a1658d3310db99f6974124479f

  • SSDEEP

    12288:EMAdPqUo+RUQyG4THPDffPr33P7rnGBUHyR15TFIpcudL5D4H444l:cqUeXTHPDffPr33P7rnhutudV4H444l

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2