Extracted

• • Target

    quote 96013587.exe

  • Size

    647KB

  • MD5

    c660656c29bc00c64f5f93cdf371e6c1

  • SHA1

    2121adcebd5cf58897b6a2775a61677494a25ae4

  • SHA256

    fd982e9e8c724d7da7aadca4efaffb5ed6e8c5d368cf4e3e4c539b5856c36707

  • SHA512

    3712bb256657877678bacdbaf30b139ef3ebb7b9baf7e64e3ca0ae447776492bc2c8f02c96abe2359f47094fe6b1afa4baf4c060f0d2074017254aab39b4b990

  • SSDEEP

    12288:tOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiGtuyF5DgOmxbnghy5SLK:tq5TfcdHj4fmbp95nmxm8+K

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2