Extracted

• • Target

    ff686bc37f9a2d9ae4f242f7b6a891d9eb44ae373fb0e41a0d0826964fd826cb

  • Size

    627KB

  • MD5

    15b2b360a1d3c5f7abd9e6563999ed6e

  • SHA1

    4784b10ea4e6fe2d86c3e1e77707ebbce64ce388

  • SHA256

    ff686bc37f9a2d9ae4f242f7b6a891d9eb44ae373fb0e41a0d0826964fd826cb

  • SHA512

    34e2f36d859e588dac297d263ea93a1dbc3746c77f1a888bf43ec5e6dcd896017cccb79fb3ca19ec48c3cb780a534f958d8593bb6ef431cc3cdbddb268134117

  • SSDEEP

    12288:quPNO9hUTQj2tZrmjCZzcbsI5DwH+K3NN01XqjV:NkrK9jSjCWYIg9qJq

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2