Extracted

• • Target
    959676cb6fe2a6c267ed731c12ec4e5bfcc6320aae7aab6524d4c3dc6f30f595.exe
  • Size 164KB
  • SHA256 959676cb6fe2a6c267ed731c12ec4e5bfcc6320aae7aab6524d4c3dc6f30f595
  • MD5 b66b1368a250aeae2f1435020691b9dd
  • SHA1 0070676b098e356dc7e08609b22aac735ad2b022
  • SHA512 6f987c535f51d5d2b9c413c6f92a1ea4fa3f3d10f9c9d72b33c0eb6d044363849abc4c1aa78e3ee001122e9d8073840624b4849d1d450da731a6f61205e58379
  • SSDEEP 3072:lnQ3o1qRge1BpZzW85i0tXqgcPxr5OmFTLwEJFajvf7E:11MAeTtrG5LfJkjX7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2