Extracted

• • Target

    DN 729950068251.bat

  • Size

    1019KB

  • MD5

    f3d4c5c46c3d6b6f245032ced203e902

  • SHA1

    2ffa30c68e1182acf0976f0b1021f523e6a0edf4

  • SHA256

    36848413f8c343c47d8bf2f8ec254d402357031b1fb976cfe925e00438119c8a

  • SHA512

    ecea94028784e376ffb79d55053f9eeca53ad9beff94b499463d710d4b111b21d876c8bf5e15ca7640a87550d366714229236bc5cb66cc1df6108426c564a56f

  • SSDEEP

    24576:e4iTYb5PEHqFhUIzJMMbhgBpUxFR2Id6FnWhhh0c2j:mYbuHaNbh0m2W0c8

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2