Extracted

• • Target

    iMKDVrJe47zuAdF.exe

  • Size

    727KB

  • MD5

    5632023035bb33557273fffb47cf484e

  • SHA1

    3a9019e6d4b424ea0872962e4bdfe102454efb18

  • SHA256

    68de9e3489ae10b2585b442b3cb29c33928e0e874c96d82a9ec16db2f2ecf83a

  • SHA512

    531b99e8ea60c7c32dface14dcd3951034779eac8f8e0e01acf7106fdba7aca6872196ee9d7ff37d7dfacc0c698249bdbc62229093cfaacdcb0f16f9b49590b9

  • SSDEEP

    12288:8dfSRtR2lq3PagfabD3GFzj3wmGBlaU6eTT/wUu8/shLkf6uHu1VlK/0dKKgwxk+:8s2lq3ya+OzjRGBlh6MT/ww/+WruHl8N

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2