Extracted

• • Target
    42ab2450f0d6513cd866d8a5bf33d728569ca37d8428ea4bec47f560bdfc2992.exe
  • Size 165KB
  • SHA256 42ab2450f0d6513cd866d8a5bf33d728569ca37d8428ea4bec47f560bdfc2992
  • MD5 05688260cd0f68779347d8e274db2597
  • SHA1 a9ebfa0a2da1fb6a81a68c358727df84e0f047c3
  • SHA512 2db04c02e2ed7ad864e02ebab3b95a0381b1be3c9860ef3bca170f108be810db956f00d32dcce81fe1a99b3329d1c343967b2053905edbf206cde07375008e82
  • SSDEEP 3072:PG/1o5GVEFx9nj1r8VWn3DjR5xf9dZRYa0ujEsxt/DwQnckuYCKFBsnVYTI:IEFxhpr0g3hXf9d8a0ujE+p8RbYPrsV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2