Extracted

Extracted

• • Target

    99b6ebcbe41f5dee9586f9240ced91429a7b77b5bec6ac396bb209a086e9c623

  • Size

    378KB

  • MD5

    2a45764742c02280b6c2cf6a694d48e0

  • SHA1

    3ed8f402dd26db32bf852305c5a9231e6adce374

  • SHA256

    99b6ebcbe41f5dee9586f9240ced91429a7b77b5bec6ac396bb209a086e9c623

  • SHA512

    97c7b6e5740117e3ea4940e0ab79658e414ac11ca927044c41178559081e322f7c009fe8c5e49da4a5b377cb859d1a25165bf4581bf07e5670a4a6af945d6789

  • SSDEEP

    6144:t1MBqs3HXoTM3exvpgkLtZY5jV+sk6+1l/WDye7Jq/YM/9k3rIstOHL6dbTZb:twqs3wM3WpgkfY5gsjyleDyT/Z923cC

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2