Extracted

Extracted

• • Target

    c69f810702c6dcf2a26218bf42023ce5d46262b84f73349b62f67d1354cb4d9d

  • Size

    694KB

  • MD5

    b58c509969c1f48e269d8cbd1dd0ca4e

  • SHA1

    486a8641f1241616f0fb432a101103773bbd0797

  • SHA256

    c69f810702c6dcf2a26218bf42023ce5d46262b84f73349b62f67d1354cb4d9d

  • SHA512

    c7e7167046e6af02714dc7e4700d7eb473fb6ad4f22e915ea917da91a79979102987557f5d53874b3c5529c9e2284c23234432dc11b9137cafa93cc2471a40bc

  • SSDEEP

    12288:zueH5q6yI4MD1fdrFNT1puNGTMaEXzkuM/QjkZR/NqabJ5L:Rq6y5MD1F5VqATuXIuMojkZFNqad5

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2