Extracted

• • Target

    fd19e12aebfd870dcc7fe04359e6e7a53daeeb281c2dfc21f7740f8e65edd264

  • Size

    30KB

  • MD5

    ed236267c78420804814d86de99b8850

  • SHA1

    21bd6d19e5664158c3d4d77ca3a2b7889827d0d4

  • SHA256

    fd19e12aebfd870dcc7fe04359e6e7a53daeeb281c2dfc21f7740f8e65edd264

  • SHA512

    7c28b89d1e7c4c429cc2528cc935839be61a5cb41c621ae48547c7cc64479df6a0254382eaab2fba52af3d4cbf261ccffdfc8d0d40043042bc6cb86f7be7af1a

  • SSDEEP

    384:GSwPLqusAKYP/GKhwlJCXOxFm7bhCm/zH:xwz9HvK6XiFZKj

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2