Extracted

• • Target

    7a5d6fb2a5427145f0df260b9474196452f23109a8dd6e317c1853de93a5406c

  • Size

    868KB

  • MD5

    5e18728978c1e620cf189bf6930d920a

  • SHA1

    72f684c4aeeca562bce9b6c442cb3980b3a2672c

  • SHA256

    7a5d6fb2a5427145f0df260b9474196452f23109a8dd6e317c1853de93a5406c

  • SHA512

    8028ece4bdc2df82a02de5b15588514dc2318aec160033d540a2040c484ef81a5449eb815e6f6ce8deefec847c24ec8e9281f9014f021cee6050b4f754da9f51

  • SSDEEP

    24576:jHCtn9BoO/NESQlQXDZ9zaBtBRWjba2E+s/D7sjJteP8X8u9:QmKN92tRWvaj/DGre0Xf

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1