Extracted

• • Target
    137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93
  • Size 551KB
  • SHA256 137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93
  • MD5 837d5e0e15b2d9c30dfa1745acfa17dc
  • SHA1 ed6c05e682bea4b1f7e92847c2b0b7ca3851a499
  • SHA512 e2046be94fc9459b67e2d73ba6acb656a498c350f727f08364d38e16a421971d3eb85dcf9766820c2818be339b6ccd211faed3aa50ec2722a1b4219c269dd4ab
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2