Extracted

• • Target

    16986487232974668ff6af372cfa139f9eedde01bdda46fd1d019b6a80a6027b15e1876a01533.dat-decoded.exe

  • Size

    242KB

  • MD5

    edc9b4f305d1232558161d5e8d466dd5

  • SHA1

    81df3694f88ae703ad516e8169665ee69da99bd4

  • SHA256

    bb9c67f2364dc59759900a28b543dae552475eaa6dfada1cd6cd230c3e44bba2

  • SHA512

    d9559b6bfece4a4452f0a1fc669dc2d58637d84d24f0822ec0165305d318b7911239d08ec0370cf99beb099bb193e99d40aaa7389589439e7d281889d570adc1

  • SSDEEP

    3072:dwXCIv3nffPa9z3fDldfHy/CjKXfkNU3wOxZ5o2U+VqC9:d4CIv3nffPa9z3fDfQMm3xzU+A

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2