Extracted

• • Target
    b0ab5156c1e5e7fc9f968b880dbf42704e440bab63d5cbaef8bf2df2670a427b.exe
  • Size 218KB
  • SHA256 b0ab5156c1e5e7fc9f968b880dbf42704e440bab63d5cbaef8bf2df2670a427b
  • MD5 06d41ddeb56d013297b1193efaa05bb5
  • SHA1 84efcfb35ae417716e85a01c825cf853d9ae0db9
  • SHA512 0a81878a6c3b8f14a0fe42c3320b8225d7cbf3d80f071e81462df1debbfe653938137f00c1fba63337ef435aa7c485bee3b0c1131a74e9b4467fde48e4b33da5
  • SSDEEP 6144:/RTetXqhWwKKHLGxGUTZbHKdiR7pjYwEIrnuz:gtXqB3HCx1R7pcvJz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2