Extracted

• • Target
    SecuriteInfo.com.BackDoor.SpyBotNET.25.28952.28107
  • Size 216KB
  • SHA256 755609ffa45b84235de59f8c546c2c2f5e95e40e3ca6df1eca35adcd47b2f7ba
  • MD5 2aa72d8ddee42fde91878cffe0ac139e
  • SHA1 c0a16b1e80741892b795bec191a0b3a897f5a10b
  • SHA512 0bfe257fdfd50b5012e2d148910b44c4bf6fc10138c28215886d7e8ed8dc66b73a92a11ff8c358f1c00989b87ab595402fe1803692c9e2ae835b6b7ad5e146e8
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2