Extracted

• • Target

    66308fea093bd07b4571d9864bc3869cb5743321444af754cc07aee72d1879ee

  • Size

    1.4MB

  • MD5

    7363eb4945a51b3b6227bcef76ebfca8

  • SHA1

    91925901cd41330ddeea364cc53354f326b091cc

  • SHA256

    66308fea093bd07b4571d9864bc3869cb5743321444af754cc07aee72d1879ee

  • SHA512

    ca0e3f6360fd9d17934be2cc6af898d00b3d8cbe367e67478672914b3991d82d6745926cd767c262deb41eb9f225be609db89b1b8e930528bbe324df707de677

  • SSDEEP

    24576:fNctGH9FbvIoxKQf9eCSxZeiXHKoWVWGNHP+b8dRuq7MKC6Hfc43Izl8S/CrPWB:aADb5AQoFbe4WhNnEsfT28SkPWB

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2