Extracted

• • Target

    Order Specifications for Materials.docx.exe

  • Size

    1.1MB

  • MD5

    ca5e9b87e7c8b8dc2b60edad5b0ef4d5

  • SHA1

    be210e5855b7ac8337da25bea95117fdd66be619

  • SHA256

    1a326608fcf76eabbcc227a1515eb23309a8e6adb6c18b2c23041e3ebf225c77

  • SHA512

    4b460524f7d9834ba089de468783df9761342de4b06255fc3bb11a4907f6eb21f0529c8ad250989d3494437f4839dc355907fd023840eb842c21be9b35d6f1bd

  • SSDEEP

    24576:eu6J33O0c+JY5UZ+XC0kGso6Fa1M+Tlxkm4ZugpWY:wu0c++OCvkGs9Fa1MQlxyupY

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1