Extracted

Extracted

• • Target

    b9173178b6035df070e0477d515bb5e1eb7e6b5416a9a19d6ef41418790fbfbe

  • Size

    740KB

  • MD5

    f0a3cbf3aa3627bf4de6298a5da8a42a

  • SHA1

    3ed87fb9e33995ad1ef9d325804c587bfe9950f1

  • SHA256

    b9173178b6035df070e0477d515bb5e1eb7e6b5416a9a19d6ef41418790fbfbe

  • SHA512

    6fbb2e3336a13301b081b39bf5b025672368902a02b55d95f3b5ef22a2c240efffb79db4af0acf6a9e655f1f4a4157c86b62a91540b1e9e8f2c1770c359dcc85

  • SSDEEP

    12288:y/36c8j8qshD3RiIJFf9zBdW0NK9mld0WHI5U+nugc/P1GaEcFRt02n:y/36c8bsh7HJFfrdW0NK9mkmkugQ17

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2