Extracted

• • Target

    5367636e08ae00354a1bfdabdc3adde3d0421130d7c601bd2faa9e2d310279ec.exe

  • Size

    1.2MB

  • MD5

    e3eee7377eba76e0929864fd08ef3628

  • SHA1

    a6fa1f8496f975acc822eb574139a75a28bc61c6

  • SHA256

    5367636e08ae00354a1bfdabdc3adde3d0421130d7c601bd2faa9e2d310279ec

  • SHA512

    65e2ec420571b71ed5238e2e388a887d0aef2f6728c9ee6665ef4047454510bc7fca441989cc6689f4effd280b192cf7f6592e7ee88a105b09cf9a35757c8f7e

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLGOdfmMJGj8vMpCei9Nuy:f3v+7/5QLcr8Epfi9Nuy

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2