Extracted

• • Target
    3868793eb582be328aff7162c6fd19b68fedc4e5cf9739dbea8bc7b013794ac4.exe
  • Size 164KB
  • SHA256 3868793eb582be328aff7162c6fd19b68fedc4e5cf9739dbea8bc7b013794ac4
  • MD5 4c4405cf1fb1a2f3629c42f144dea526
  • SHA1 033ace210ad3ea2df22a431d35f36ecbe2fc63f3
  • SHA512 7550382f0ed0c07d9a4c69123d229609e92258b49201aa984aa36b12e7a9243220fc11dc89293b2fc3883e9ad911600c3fc16a05be7fba588ea1a8447de82819
  • SSDEEP 3072:Lz1/yotcQLET1cluNAj3QH/jFCpzBaUKJrVw4MNK:LzlbcQec4yLqjQArwjN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2