Extracted

• • Target

    cdf6ae802390cefc6f276f7d0b8577d1befbc25b8e912e634e16027d6f520d04.exe

  • Size

    748KB

  • MD5

    b659114c7cc72195ec1af895afe3d03a

  • SHA1

    585f5e4b70ad8bd4ef004079d6008d8f8bd97d66

  • SHA256

    cdf6ae802390cefc6f276f7d0b8577d1befbc25b8e912e634e16027d6f520d04

  • SHA512

    e39b1c147c8cc9130cb5f762377df448fa93b54fb768ef148adf892d25f18b8cedd0766f686625849aa8a15e75016ed76bae1caac9ee08834706307f1d3fae45

  • SSDEEP

    12288:qeEnQmbCpQIIcQ3XzwoPjahExtNGdZRqcMr+XpbDeQMgBy3Qhw0mqAbe:iICXznPjcCEfq+XFyQMl3Qxmq

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2