Extracted

• • Target

    18b22003c8337f861d0f2116a758dc05e5d03de7a585a24f5cf94ec896153ffb

  • Size

    259KB

  • MD5

    01469b82fa2bd20bdd7356430cc35219

  • SHA1

    a49c5c852c0e4ca464daae6ed78446c64060cdae

  • SHA256

    18b22003c8337f861d0f2116a758dc05e5d03de7a585a24f5cf94ec896153ffb

  • SHA512

    ac0ad7f9d572d6cc8af08ff4eb23ad95c4f9ee43d4520f7d1d863959a1a20a6f29261b3731f2c0a15d63eaeb35fc8c980a2e6ec4ff996a27bae9b888d01d012b

  • SSDEEP

    6144:6g2W2lWoI2MydG7GldO9qDxN+CnwXolbclTr1:l2Nflk2wzv

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2