Extracted

• • Target
    QUOTE 213DUB.exe
  • Size 1.2MB
  • SHA256 2aee5eb975d16feb1036dbf8298c4b6dc6869de8b44065caf8101a1f40b3b6ea
  • MD5 0b5b27ae4f3286e2002836882d0919d1
  • SHA1 8c0d4e116c48b67bae52f518d0b795c461c011ab
  • SHA512 a6df2be93836dd8fd8c4337bdcb7b574fd319734669d6055eeade1b00d3d86adf895168250391aa7ca920f56509cb8e08c866e361957ddaebdbea77f1f8daa6c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2