Extracted

• • Target

    PoToolingCT24023023CTA240714.exe

  • Size

    1.3MB

  • MD5

    0ff78cd7bb7650ceae70f16df404c664

  • SHA1

    512f82194d080f800d339bb9f18e43329bebfac3

  • SHA256

    c2fdf0438984ccabe7c3c032fa7136fec9859cabf00e83d6a5915649fc7e89bb

  • SHA512

    77d71a01ca169582234b37b0826796b8c29d6b18577da56f72dc5f828feeeab342e7c63aa06b92acabfcc22a7c674f20dba09dbde01a20c6f4e0726c7d3bb1a3

  • SSDEEP

    24576:R93pGRzhB7La7tj41esme5CM4OjBa/n3G9CJMsDBU9ZFncMBeY1qC:RMH91Hme5N23EGMJcRC

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2