Extracted

• • Target

    363da150d891da7bb5da8056414882429067a0fcb27f58363567567bf18a323e.exe

  • Size

    598KB

  • MD5

    ac4ab3c4b9386b0355d8645f77f91e3e

  • SHA1

    b87289c4a2290c6efb49ae38373a174f7d34c4e1

  • SHA256

    363da150d891da7bb5da8056414882429067a0fcb27f58363567567bf18a323e

  • SHA512

    7d7590ca7b41fb0eb0b31649aa2c6ba69830b55a28df49c5a089b08824c0f91fbf1f2173c2ed9f95e713612cfbfbc9dbe684bd84cdc5fb70816f07184ecf10a2

  • SSDEEP

    12288:TquErHF6xC9D6DmR1J98w4oknqOOCyQfKSpoCxFI66E9:qrl6kD68JmlotQflposIjs

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2