Extracted

• • Target

    R09876556789000G.jar

  • Size

    1.1MB

  • MD5

    89b1c7884d5ec1bfc18142f725fde3f8

  • SHA1

    e95ab3a5eca60dd08fe4703abe420a29cf357a2f

  • SHA256

    b79d1da91f9a15f6bc930bd5b4bf714c016862f04052c3dd5cb79c3464e0f775

  • SHA512

    1f81f2de35ad05321fc3761b601a1a82af7e64d93f5072acfbcd262a34ae8acd610a93629369963dfa35e893aae7b423030456a896d11bc965544f73aa94934f

  • SSDEEP

    24576:EoOQtokLVRpJOemLmrq5OI5HR735U09kLVRpJOemLmrq5OI5HR735U0C:EjkBRpXrq5nHR779kBRpXrq5nHR77C

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2