Extracted

• • Target

    7d1433cbe3f549a132b60579236df74b7eb641aabc249927a7621881f74694db

  • Size

    1.3MB

  • MD5

    4b9ef15314017fc83c7eea21dd5607b4

  • SHA1

    997669512734756fe74554f0c1accd9d10e78865

  • SHA256

    7d1433cbe3f549a132b60579236df74b7eb641aabc249927a7621881f74694db

  • SHA512

    b062e3ede40853dbe476ef31dfc9c882e2e4ba6119a727218204ce103b2a7d4d38dc0d57338825420553f1561063333e5923e9c53176b92c456fb30e1e3b1a14

  • SSDEEP

    24576:H4789o3zfA8fWQNmpC0M8IV/Fl4bwUKzaMw9R1MF0HftEnF4f61qj:tO37fWQNmFIV/FNAXU1OfXj

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2