Extracted

• • Target
    aa64f84bfac1047400eb05f1a8a4c9876badb46d76d7bf58587cfef60edf0485.exe
  • Size 238KB
  • SHA256 aa64f84bfac1047400eb05f1a8a4c9876badb46d76d7bf58587cfef60edf0485
  • MD5 d8a8a5f1d475fd9a680971d1ef386d7c
  • SHA1 d2d6dd6acede77d2da752654a1ab834891845972
  • SHA512 0e2b7efaa8d6180e1a624ec5dd0a716b0695e357ca23c80340198742bb8a15229ff26a46e04f5e6f28384acc90200cdefbd85b4b8c968158a9da6adc43cdc79a
  • SSDEEP 3072:Mu5vKz0l1RqRLYwQbNZ3WeCF1DMapHNGv:JK0ljqRLYfbv0Mapw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2