Extracted

Extracted

• • Target

    1f945d083df98f17a057c881fb022efcadcdc709a4fc1188b8cd3f91a6db17e2

  • Size

    801KB

  • MD5

    fb28b56faaa0220b3dc1b57e2bb8f6af

  • SHA1

    e4522a685dae0cce6062a01fff073552b6ef9c08

  • SHA256

    1f945d083df98f17a057c881fb022efcadcdc709a4fc1188b8cd3f91a6db17e2

  • SHA512

    fe46999ca65cb2cb54e4cc5639d5da0ef8be6daad0137a4eee1a7bb5db4287646bcb1d46951d43f7b7cc5228f639ba6e1cb15b660eda2ded71a1b36a1a420f15

  • SSDEEP

    24576:JGKtD/61I6IK2IKUnCcqMLJjNRctimoE:P6K6IKdtLJBRuimo

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2