Extracted

• • Target

    eacf712d6ee65e4002090b5fd2629e97da8bf0b90de3cafb3a7a590cf84895a8

  • Size

    863KB

  • MD5

    0bb260c0fa360e59553b86a7d94bd09a

  • SHA1

    ddfdb07448646aefaeeb749b517740d5d06484c2

  • SHA256

    eacf712d6ee65e4002090b5fd2629e97da8bf0b90de3cafb3a7a590cf84895a8

  • SHA512

    604e774697a17f16b2c15a06a8c752080554c4f11812d5eb56ae3d3e19887592c4c442f706201f4ca951e8a0640007386ab70a47c0e959b4f6b3721ca823dc56

  • SSDEEP

    24576:0q5TfcdHj4fmb1MczV8fogZWI21u1ohRZM3HAw:0UTsam/b+Wc+nM3

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2