Extracted

• • Target

    Shipping Docs Waybill No 2009 xxxx 351/Shipping Docs Waybill No 2009 xxxx 351.exe

  • Size

    1.1MB

  • MD5

    354725d3df06a1f01c0fe40b5613f21f

  • SHA1

    28a300ab00a8e2d8b218adc084a2b946309d4fb7

  • SHA256

    635e20a681b1d8e8a4318e345cff50dc04cbd032a7414640137cbf5fa1c09a84

  • SHA512

    9c8b7807ce0531a688c26426b90352a6d21f9cfe7df480d484bea46d451ba5e6f6a56570a86a6be6673a6e38013ddb46bfbdfa9115c216c7807c6fec5218b78e

  • SSDEEP

    24576:yr/LaBQDJDFlGOhvP7iUOpqYqjpYlA7dfUWTpSuaWV0cMc92:yvvDrGkvP7iUw98p57dflbaWOcMC2

  Score

  10^/10

  discoveryagentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2