Extracted

• • Target

    Ref#2600902.exe

  • Size

    51KB

  • MD5

    48d5264b4dca7aa56915e7f378e9ab13

  • SHA1

    e0e384fb1257c17053cddfc24e6a071de6f99f97

  • SHA256

    f9ee3715793db624c00bf0f71624c483729719d0dce15b4922b52f7422a420fc

  • SHA512

    2a3b0b5a0e357217421aa55302d5eea38294a0ad28d9547dafa30fa3f3d01cee6f9588113068f624e5287b4f50d2154123cb83f8f235cb49835f6d11fc9a9e2c

  • SSDEEP

    384:MQc7UaUMrg7ilYqCndq5I16MjSj67WBTc0bhfefTZ2GShq6ki2lKxiIiW1sQS+SG:PEDrgsCKE01f37F2zInyQS+ST6nkC1

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2