Extracted

• • Target

    Ref#11310057.exe

  • Size

    145KB

  • MD5

    4695c58b4e2dd8c7865ccc0bc0693367

  • SHA1

    a8d4b077cd63843ad5305b063aa1d95a4f398eb7

  • SHA256

    3a56216ded9e2b6fae078b2c0beb9601d8404444818bf9e413884e3cd886d8f8

  • SHA512

    27de43000cdb506632ac01049d767fbd1ace0783d2914f0d16083458f6555474159fb4e5345cd0b6e18ec9ddff95e74678077910a4ceae500229084da9f366f6

  • SSDEEP

    3072:rqoBB1EMoND5/7CbiAGtt4mt2PRKjIUuppC/j:1RkFAGt9MJKYW

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2