Extracted

• • Target

    c058481ef3134e855db9aa2c9967b91eac8cb557c64bdd006d514653559a75ad

  • Size

    2.1MB

  • MD5

    71d630bdcfc09ac5bd3ba28bdd16c129

  • SHA1

    34134d6781ce61ee02c864161e0cbc62aef7f223

  • SHA256

    c058481ef3134e855db9aa2c9967b91eac8cb557c64bdd006d514653559a75ad

  • SHA512

    7b41e2db30cbc160a7e403532ba6299d6d2a5781ca9a4c0da8a8039d51634a232f12f21647139276a15a93f8fc5de5c8c699bd04e1ed68b2af91c3d602601e78

  • SSDEEP

    24576:6Rosm0CSpYZN4B6L6Kl18mVLyKW8XLymlxbTZNDykNpjQcYW6:

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2