Extracted

• • Target

    rCHARTERREQUEST.exe

  • Size

    145KB

  • MD5

    9773f17f57d5a69d3a69eec6def1a8a3

  • SHA1

    86e0269b21c64ffdc344ef0792fbaaaeb058d416

  • SHA256

    37fbb8aab11fee86746dca42f37cc3e1f8af646d595cd292dc04963d9c82b89a

  • SHA512

    147e647e91fffb2fd3e674675b6d4ec50882696d517cf6f730136860f7c2fb9847b7cb0a7b4be4f7a66ba9ad9484b0bf9430729604b720031eb0bf9adc266788

  • SSDEEP

    1536:xqvP1g8HjZfTiLX82GFmnGtGfIIcDjp31lDKqWIqHOVdh2iIC/m8:xqn1g8DNOM21nGtQdGNFlDKjId2pC/j

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2