Extracted

• • Target
    fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5
  • Size 551KB
  • SHA256 fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5
  • MD5 49f79a683a2e3f61be490de4e715049d
  • SHA1 b4f7e8138d74641b0dea33c9cc524d53d8c4d668
  • SHA512 4af825bfe7873053b3b19ec7abcc328ddc60c91d5b4b4107c9393cc689e7ca443b8acd5c2ecb5070388cea60fb14f3ed73fd7a7068bf4a4763c4e6ea1f1855cc
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2