Extracted

Extracted

• • Target

    2cdcc1d29030507ba28587a131f8b98b8c2ae4834524b5e1b584937ce0527ef6

  • Size

    428KB

  • MD5

    9ab42dab7f35c8d542ad44e9e6c0f0ca

  • SHA1

    a6f0aa4fd5141c92cb506a77b1c3604c7a60d608

  • SHA256

    2cdcc1d29030507ba28587a131f8b98b8c2ae4834524b5e1b584937ce0527ef6

  • SHA512

    fe7ca1ace6cbd1a410fc96d3f92e19a53f0d7b46cfe458ab076b2fd59704e7a1d72833526a78b1c5a469e961f5735b8874c00fdaf11fa097a8e99db55f5661d8

  • SSDEEP

    6144:Q7XEhgANGThYl152Jnu9u95ik0uZWRQ6uX7Ee/AnBDxq6Tlv2222+v8WEjeNplzQ:thgANZl1SuMLikaI7TIxq6c

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2