Extracted

• • Target

    0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9

  • Size

    599KB

  • MD5

    9b46500828b338eb4cda1d49bed1f791

  • SHA1

    fe2f2d5e222765e585a61f80c33b061f643e7107

  • SHA256

    0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9

  • SHA512

    5a6e39f1064f7a1db77fe8aab9da039f9340630ecf1379ef28061d857908107ccc884389fdc064d13b5c80fabc417d5d4061a718465f0301e9494c8db109e918

  • SSDEEP

    12288:AYV6MorX7qzuC3QHO9FQVHPF51jgcQxNAQ8d6dLOXsGdxpM8E:fBXu9HGaVHdkLO/LE

  Score

  10^/10

  discoveryupxagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2