Extracted

• • Target

    7cd4fb83f485524e6a176ec1d6d9a5a21e2cda287050c4ecee6e47e6a3b35911

  • Size

    103KB

  • MD5

    be6afce715f261658914e050e2b3919c

  • SHA1

    137d53925366a03cc0d81d2195c82fd023c4006a

  • SHA256

    7cd4fb83f485524e6a176ec1d6d9a5a21e2cda287050c4ecee6e47e6a3b35911

  • SHA512

    104addf8ddcae2b9ee6ade0d15185ff967530df51e1e86b04d40e5286d79a532cba2e1da8287a5938a54c3f12518a442e9faecb1adfbe0f1d4b4338bac46b63f

  • SSDEEP

    768:O9tVmtzb9+Kn2Kf9HRTyovn612PPk/DBfmHd7ugpYsF2zIV9XeS+ST6nkAv:CtVHKpHRT9kgHdShWiIC/m8

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2