Extracted

• • Target
    goodthingswithbestsupportforme.hta
  • Size 391KB
  • SHA256 6722728ffaf2daa86aad943b33bbeee5fec3eb9da19a7ecf458354ad9b501070
  • MD5 78fe47876a3e44081148f5c126bee700
  • SHA1 258c479651d7940b9742c9a39dc264c39e2595ce
  • SHA512 a7352ce3947cfa67a5b1b4bcbc0d59b42dc40c8505eb8efd26fa676af6484c334904b795cb68deb56a18575b7ea87790de5764f0fe40ee569a77f8ce0998fdb7
  • SSDEEP 3072:QGiSRH138ppFYXVXW76370UvVKNvVI5EZ:TiSRH138ppFYXVXW76370UvVKNvVI5EZ
  • TLSH
    T1E6840873228B8BACA5DCB9048C1EE0D6EF7DC29D2A51574D385CD0C0AAF464E51B9B7C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutioncollectionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2