Extracted

Extracted

• • Target

    12b0b70b17d9fcd3f745e15f4a26c9dbd9a56bb9de6ffca349c7e9a0b5cae723

  • Size

    693KB

  • MD5

    1b6a6d8b30c72cd3f29bb771473513eb

  • SHA1

    2dea7685282c31774c0bf7e73134a9896a8ae3f8

  • SHA256

    12b0b70b17d9fcd3f745e15f4a26c9dbd9a56bb9de6ffca349c7e9a0b5cae723

  • SHA512

    521d8b98ea91dcbaac13f65dc10c53399d90898da1393c074e152d3cda234c686b1b7abf30e81852c446c16d1bd1e2e0c2a1fab43db915efd9abc907a0f07812

  • SSDEEP

    12288:jaueH5qrBVCNI/IfW7Rvja9UZc98TLVW17CfQNOWr+3R:Sq1VCNI/E0jaSo8VW9IWr+

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2