Extracted

Extracted

• • Target
    goodtoseeuhere.hta
  • Size 10KB
  • SHA256 12dc3bd74949a3306d988ee7d2b28865f8363670b2a910063e72de46c9301380
  • MD5 516080cf0436c188eaa2a0da37f3007d
  • SHA1 22f34f26e786521d1a655958e3e5148563ac28d3
  • SHA512 8d2bb79ec59c935c5ce04ed7b8853ca9ef866fee46b8ecc8b2da8fb726b5b423213b43ed5fecde900114b7cfa9b02869f02f40e12a0bc27843bb4b95ac5493a2
  • SSDEEP 192:Fpen6/HgkrjP7nbdKR9W9kjsgvvc5TUIXIAbDxa:FVgHG7l3xa
  • TLSH
    T18122BB254DE6996E313956F5C208B6408AA17C2F1753A9C5FD3D874BE723222037EB3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2