* MalFamily: "Malicious"

* MalScore: 10.0

* File Name: "AgentTesla_44273c17f687f6b76c3afbb5be38932b.exe"
* File Size: 573440
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "df0b0985285aa11c107ecb0d3f4bc0964341ba1eb1bcd5a835d7c01ec780e1ab"
* MD5: "44273c17f687f6b76c3afbb5be38932b"
* SHA1: "3bc33013f4190f3b6c456d96ba35a4090a9e8843"
* SHA512: "6ec1b201ceeb2260849020f0ca5989492e6438204b7cf42270589f2e89fe11fb92e553011736bfc3193b3cd7beca5e48a9c4c9cbda5bef9feb507e9fb4fcf73a"
* CRC32: "F33AF81F"
* SSDEEP: "6144:gU2d/baX4seZx3NvY3LcgljX7FMiL4NC7Im4WeMEp7gPZNzyheRddcwrJnc6lVoF:Md/2GrNgjjpMiL4N9OaOGhEdGt6VoMo"

* Process Execution: 
    "AgentTesla_44273c17f687f6b76c3afbb5be38932b.exe"


* Executed Commands: 

* Signatures Detected: 
    
        "Description": "Creates RWX memory",
        "Details": 
    
    
        "Description": "Reads data out of its own binary image",
        "Details": 
            
                "self_read": "process: AgentTesla_44273c17f687f6b76c3afbb5be38932b.exe, pid: 2952, offset: 0x00000000, length: 0x0008c000"
            
        
    
    
        "Description": "File has been identified by 18 Antiviruses on VirusTotal as malicious",
        "Details": 
            
                "FireEye": "Generic.mg.44273c17f687f6b7"
            
            
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            
            
                "Invincea": "heuristic"
            
            
                "APEX": "Malicious"
            
            
                "Paloalto": "generic.ml"
            
            
                "Kaspersky": "UDS:DangerousObject.Multi.Generic"
            
            
                "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.hh"
            
            
                "Trapmine": "malicious.moderate.ml.score"
            
            
                "Microsoft": "Trojan:Win32/Wacatac.B!ml"
            
            
                "Endgame": "malicious (high confidence)"
            
            
                "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
            
            
                "AhnLab-V3": "Win-Trojan/VBKrypt.RP09"
            
            
                "McAfee": "RDN/Generic.dx"
            
            
                "Cylance": "Unsafe"
            
            
                "ESET-NOD32": "a variant of Win32/GenKryptik.DMUB"
            
            
                "Rising": "Trojan.Wacatac!8.10C01 (CLOUD)"
            
            
                "SentinelOne": "DFI - Malicious PE"
            
            
                "Cybereason": "malicious.3f4190"
            
        
    


* Started Service: 

* Mutexes: 

* Modified Files: 
    "C:\\Users\\user\\subfolder\\filename.exe",
    "C:\\Users\\user\\subfolder\\filename.vbs"


* Deleted Files: 

* Modified Registry Keys: 

* Deleted Registry Keys: 

* DNS Communications: 

* Domains: 

* Network Communication - ICMP: 

* Network Communication - HTTP: 

* Network Communication - SMTP: 

* Network Communication - Hosts: 

* Network Communication - IRC: