Extracted

• • Target

    531ef612c34f2f94eb3fa0be4cdcfab561bf97bcb45cb04481b75f198ec10e9f

  • Size

    955KB

  • MD5

    13b6fcd409c48bf3101b47ba8fc16c97

  • SHA1

    fcd48c6ab679001b47bb5703eff6a3fe1d508404

  • SHA256

    531ef612c34f2f94eb3fa0be4cdcfab561bf97bcb45cb04481b75f198ec10e9f

  • SHA512

    2a7d89941586588fa2e4d925663b570c4e7b8388e1c76dcfa7060f39be56345c4c0612018cb8e400665bfe784d9cc0e041f6e93b3ec18d77b1b15a1413ba9d83

  • SSDEEP

    24576:fvpqi66Y3y06NDIn0cVtNtot+O2/0Ng4t9zLBGqE6:fR0x3cNqVtst+O2q9IqE

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2