Extracted

Extracted

• • Target

    9a95770cc4686d6d14f68d10a33f15c82118673fb08232aa0c7b0c1c6783a4fc

  • Size

    559KB

  • MD5

    2ce65ae1f22fca86cf769233ff101ec1

  • SHA1

    1414e05776ba1b9a4420b4aea25e2ec7dc77657d

  • SHA256

    9a95770cc4686d6d14f68d10a33f15c82118673fb08232aa0c7b0c1c6783a4fc

  • SHA512

    08e23b7ca5c032995900a87bde81fb0e5d40141d9623056eac87c0778606a9078f6d140aca5b65ad3689eac5ff9fb0503f5ec7692ee57629313a5531ea905230

  • SSDEEP

    12288:1m60pEHTdQcJpI/esvCX6thsPg4dg2XeLT16L0XWgSTr:1z0C5pIWYCqthR4dg8m6LRgST

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2