Extracted

• • Target

    1d4517cd1fed529f9080fa890d99fbe96bec32213c9cfa6117054ada423ea8ff

  • Size

    907KB

  • MD5

    1e0582346d91496aa60ff524e9ad7408

  • SHA1

    4b8c3bd5cbc31b87087dca71f2dfc3bec4341512

  • SHA256

    1d4517cd1fed529f9080fa890d99fbe96bec32213c9cfa6117054ada423ea8ff

  • SHA512

    26d007f4c7df1f05f81e149f22e9daab424e3d5c465018b1430281d3204f99395ac899dc07b92942a6f764904f38d31334a596faa31d462be502f45d1f30911d

  • SSDEEP

    24576:/1Qwe3cOQAn7tnqI4yuz+jvVb1kWviYsL4/5OUh0nf:/BGZqOu01kDbs/5O+0

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2