Extracted

• • Target

    907ba7efd4c01cb0518ddadde46f600ca133f6d7d90d2295cf4b1311b3bfb9cc

  • Size

    736KB

  • MD5

    cf58e9f2e32bb4a5c398576a67691d08

  • SHA1

    93afca1fe2e24c970aaa845ed43c5e9d587a6a2a

  • SHA256

    907ba7efd4c01cb0518ddadde46f600ca133f6d7d90d2295cf4b1311b3bfb9cc

  • SHA512

    8cdc5dd4dd3c8b8c9259102c8aaa069cc660a1d9eebb0584873881a2dbbe2eb5c5a403937d54711fd6aace582cdaee8c2a1722b515dd18e888ba745b1d520517

  • SSDEEP

    12288:mAW5nF8ME6jD/QqtCzqF0qEXCBchelbBvNoiA3iYXYiXgLqHTc1f79VxoFKMY:mnPtD/QqtCu2qEhhgvd0iYokw1f79XG2

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2