Extracted

• • Target

    58173548c2124b6a23d02762e8699b9bb1d8f7fdc2b4365a7c1f97ab8639c1d8.exe

  • Size

    165KB

  • MD5

    c89482b360023c802773f550e0671489

  • SHA1

    b8e5d08eea312845e27c1d3265f5288ee1482135

  • SHA256

    58173548c2124b6a23d02762e8699b9bb1d8f7fdc2b4365a7c1f97ab8639c1d8

  • SHA512

    69417420c3071fd32109309c5e33a4a3382942aaae082b0c44fa9297ed7f1a3d08cd4a0c600270c17e02f6bed262da5bfe87b3ded4dc539e400d4569e3968f79

  • SSDEEP

    3072:Kp2L5ogpd5Da12y34BNNjwux3IuN0FnMXrkKscKH59T:hogp7DALo5ZMFUuPZ9

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2