Extracted

Extracted

• • Target
    PDT5737083-HTCOSF0736.hta
  • Size 32KB
  • SHA256 65b38711711172a1ed32dbada487d04915d6625fa6990acb4aca7c1d3fca8ddf
  • MD5 115a158516251b4a89b92263454c43fd
  • SHA1 81524998769bc0d86293708fb6c7af5296ebf872
  • SHA512 f17f4bee5b6b9e2877c531089991f75572daf9d0e0e2662a4ffda9221bf7787f851e53fe90fa575030ca67c75a97ac939d8394ab766fcc0fb3cf9445189f6fbb
  • SSDEEP 384:Fgd0vLozt/QZ8lIxAOCuJ/xy0tn0vMnaMK:FxK
  • TLSH
    T1F2E27A01BE16BD4A0B91B5FF256F095D23584A85F0B816EFE07B82773EAE0EBF550841
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2