Extracted

• • Target
    52c1c0a68da545fd829d2b5ed7c2b4f4.exe
  • Size 1021KB
  • SHA256 2268b02851b88a3dc6aea375ec1a36b9ceca5def60ca62e2f47d22db566e1e7a
  • MD5 52c1c0a68da545fd829d2b5ed7c2b4f4
  • SHA1 bf3b7e3067b60d9963d33583e9df2f4f6fcc4da3
  • SHA512 749745f9a77d1b8bfef5c1a5ca301a55c80173fc5503ddd9e63d4d2b2ab4a128d60a9fe971b5cad910ec79539cf19384008a092a91f905e1d30a92264cc05088
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2