Extracted

• • Target

    3849c5d43c8a30b7aa96995c6954e586071598f57c77f089a0ea71a5f56dae5d

  • Size

    144KB

  • MD5

    2c1d3d0d9bf96048a6fb31a753644dc4

  • SHA1

    9ee2a3ce4709c7fede73418d36e4508e84fb9f34

  • SHA256

    3849c5d43c8a30b7aa96995c6954e586071598f57c77f089a0ea71a5f56dae5d

  • SHA512

    e7df575879c171e49edc3cdef365601d6ebe27cbb7268ae22e023c64024bf423525a6c2e13f914bb53243c598d21b502099b12f20b0c630def81c2839a8e3ca3

  • SSDEEP

    1536:9qxqvXwcZM6y4C7cWdCE5v61GzguvoOI0ZJacItGtq5v5VKqWIXUVThUiIC/mV:92qchjx6YHvo2AtGtq5RVKjIWUpC/y

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2