Extracted

• • Target
    4b54cee8f8b2575cee216504872b9849201aea876327300a57d34f089ecdcd57
  • Size 82KB
  • SHA256 4b54cee8f8b2575cee216504872b9849201aea876327300a57d34f089ecdcd57
  • MD5 82f6f49a4b1c33f9bf2a1e0da3bcad20
  • SHA1 24d5cbd24e358033cb39e021395e071f2c50d436
  • SHA512 1a375554c8bb0fc46f0ffae2b2c3dcad9b886074ba1922d4a9a354f26a92f3d1f61fa78e2fe8d510de79574aa1b3f3acb9e09c63352ff845561e857fb6aef31f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2