Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.1712.15669.exe
  • Size 684KB
  • SHA256 ebf830b54a27c0e76363ae7c9fb6e40a7f28c70da7f4d10d05bcf8e27766b56e
  • MD5 f1bfb26e91ba36bde8470d0776259d54
  • SHA1 102ef1ace03c3d631d894389530048b9e349c5bc
  • SHA512 3f161f06dfa284350aa0d20b7c3374348e3052d198bf7545cd519df723d1ac9eebf2b7b3fcd68a8f24d010b07e34c5c93cd6c514dfd79cd234068fb10e997ef1
  • SSDEEP 12288:6BAyS6ln+flo/XciMvYys8nnS1Yo8b4G7Neh4vfPOS+RXcryToHfsMIkpnRs:2AXTdCjEYqnSB8b4Ac4uXcv/s2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2