Extracted

Extracted

• • Target
    8nNjOOKbudRGqnT.exe
  • Size 636KB
  • SHA256 d7836343c72fba0c84b9616612756f1b6bd4ba0187180c84836dbcfdbd0dff75
  • MD5 5a39cd5584578108a3b6e71a718c438d
  • SHA1 397310fd5f476b85bec9c8c2cdbc938f1d1988af
  • SHA512 b8d300cba2c75f57d2120ed5c308e4fcec5dce7a4324abb2bbcfa2940fd3ac6e4a03aa5c07b01b1ccf927dbaefd3ed41beb20b73ac3cd6affd39d367c7d34847
  • SSDEEP 12288:qS/mzd7BR6wTVRWFbPQaC3Y1opjXGRWo+FUsUsOfsyAJnLFFEPepi:qS/mzpBjyPQaCo16jXSGOFtPAJn5i
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2