Extracted

• • Target
    f5904a66a7961025941fa1c08e6f9b44.exe
  • Size 706KB
  • SHA256 fb5c8438c12b2a2fafeaedd0d328c2669d6c8ef6fed06455e630d1edf4d47651
  • MD5 f5904a66a7961025941fa1c08e6f9b44
  • SHA1 bdb4086f7f4c586ea16d572b95bdeeae08e3efd4
  • SHA512 c7ad92bcf5d1d41d67bf9dbf3a6a7af4644ad346d392f220ccc02ecf9c116542c5e455c1ece68b8d93d808f10a44a990358d9f1ba6d7bf6c7924ca2e4d4e0190
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2