Extracted

• • Target

    6934ac3b946dab8001c3f64f506052e846197065497b16cabbb6163d4261e98c

  • Size

    1.2MB

  • MD5

    115e174187d5433a053e4df3946d688b

  • SHA1

    ea4a06de4a04475729b45326f67ff72a630c2fbe

  • SHA256

    6934ac3b946dab8001c3f64f506052e846197065497b16cabbb6163d4261e98c

  • SHA512

    c030bd3fefacb411d3bba0b4820a06d1b78b2f11c7b276d3079495e046309ecfd62cf55154cf9cb54b82de51fc91dd7b61b580117ed23cc676c42cd1c5e71634

  • SSDEEP

    24576:XtNybsvU8Ivf2xcyqYuvfwq05jZMlDGgK7B6YuWRWmR2JPAMZ20FF:fybJ6huvfl05jZytK9FzcqMZLFF

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2