Extracted

• • Target

    b263e1e0903067437ed4e762642d1d59294823175ff56278316b0aff8b9d566a

  • Size

    239KB

  • MD5

    d60c43fc795ee3b01c9336e6f63fbfeb

  • SHA1

    c85f30e10befeaed035782de9def9f98db509b44

  • SHA256

    b263e1e0903067437ed4e762642d1d59294823175ff56278316b0aff8b9d566a

  • SHA512

    771d9d942146dd8fe62c4abd678f63c7b20b19126a7a4fc7375fbed519bbd81f71b3fa7462a2802f42f7a3969199c8db1edcc5c670439bc71926c9a196108928

  • SSDEEP

    1536:S87aPcF38d8W+lwM1Bu0RF0ZzImtosgwrtoFSnRTZm6mf78AbyWGlPq+2q+MBLA7:SIqY3QslEn3ElbEr20bGX6nsfXT

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2