Extracted

• • Target

    de932fd5a90b8d80a6b6223d46b905f3dc911ef96e5ffb084386f614f2d2dd8a

  • Size

    732KB

  • MD5

    81569ed8fd1a3ae9141e1ca9ebc6e3f1

  • SHA1

    0b88ae280590d423d0970d5afcf9b7ab984d2c27

  • SHA256

    de932fd5a90b8d80a6b6223d46b905f3dc911ef96e5ffb084386f614f2d2dd8a

  • SHA512

    fc2071d62453967631389ffbddf6ea358d1f09d67d2259b26ef858d303ac2a0ae1094283110960abdd288744e6d24d8f037445066a44ddcd11bcc0fb24c9bbd1

  • SSDEEP

    12288:OZRNsgqnTxkQlWaCMSVKptJKpeKBvMWZqyQ/F+lqCnsxcMFRCdOk:6RvqntksCCtJVKVMWk+Dsx4

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2