Extracted

• • Target
    dbab006dbc87657b92920f2cf8aacaa990838af10c55262c5a18d12c8f16f45d
  • Size 722KB
  • SHA256 dbab006dbc87657b92920f2cf8aacaa990838af10c55262c5a18d12c8f16f45d
  • MD5 5a653152ac7baf3be5ed14405b979717
  • SHA1 2103aea54dfd1e22801c1e4d2562448b418c5024
  • SHA512 4fbcff42a0ab84e89787378dda420e9408c55a676457c93bba5fd6222d2901717e8b1900779e39d4c7ee2b5e7b45d98b3358240436681ca138051a7383101876
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2