Extracted

Extracted

• • Target

    b4505984575d9ea01e84c1d68b9a4bf2320af90570d05e4e73cbe3778a02e959

  • Size

    842KB

  • MD5

    f918266716676393150c923659f80e79

  • SHA1

    24083ba3b3ef71e4e4999c19bfcdd79046db54dd

  • SHA256

    b4505984575d9ea01e84c1d68b9a4bf2320af90570d05e4e73cbe3778a02e959

  • SHA512

    72ea1edef4480c046800d69deab32b1a40b3443dd4dd0a5c1ab00e971eb1dcbc34434501eea97c574e8d7510efc9ee75cd75b4b4c189da47439e917c20b3d477

  • SSDEEP

    24576:N0pk+pJIdmMDwTWHfCn5/KzyXEHSVq51:aFJIdmMDwTWHfCn5CGG

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2