Extracted

• • Target

    ee0ba8111f35e78e4e82d006349e9135ae802229f0b55d2db47c5a84b4aac3a0

  • Size

    1.2MB

  • MD5

    0399527491e1f2bbbd72c1101b09b891

  • SHA1

    dae095c3f8374d8e8145be980931b4629d28d1bd

  • SHA256

    ee0ba8111f35e78e4e82d006349e9135ae802229f0b55d2db47c5a84b4aac3a0

  • SHA512

    0f1c761383f1bbdebbac85f2457bb1aaa0670712de7574992bd06b08964d73f444dde9f864635ce27346470dc7da77c63cf8997817cedbc568bccefa2ff2199c

  • SSDEEP

    24576:d+S+8kWaw7bdFCsh+LxD8evJtBofgMLJ+jKmlbCOAagkloC2F:d+SDT9YshMpooc+jKJNaxoC2F

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2