Extracted

• • Target

    90ad71b7f42ae66fbff825990e938941ed8b6d129f2221206e6c32541c5401f2

  • Size

    6KB

  • MD5

    df5fa561b0831eec691f7877734c9508

  • SHA1

    870eaf0be70260dc974f550c746db3c250c72f6f

  • SHA256

    90ad71b7f42ae66fbff825990e938941ed8b6d129f2221206e6c32541c5401f2

  • SHA512

    1c391c25b3bb71d8cb72eecef0d1858b199b29b531cd1ce6f1bf4a00ec9940753335bc246914741383ee696b3fbb361467dcec58e307ff3fb464441e2db6a3f0

  • SSDEEP

    48:6JmWJhan28UahrnNkwtSF8Gx1RvtNMw+MMn8YqIjchOEt0nLwlPM31s+JCtDvlj3:IZ8hewtMzlp+l8HIjcsxsx61b6xYzNt

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2