Extracted

Extracted

• • Target
    2ed67b7b3aa4d090177430d67a07cafdfc25e754604411ff68bf610b892810df.exe
  • Size 715KB
  • SHA256 2ed67b7b3aa4d090177430d67a07cafdfc25e754604411ff68bf610b892810df
  • MD5 86d0186be0822a6a181878147843a89d
  • SHA1 2581dcf2284e6d325888888c71866698ce878eea
  • SHA512 d9ad7c20cb05bec95aff1c4d3caf39e0a21447f2c48135c17930d66fee522b8a7496be2c0e8ff025fa8022ab114838ed4c335e921af51ee3fca4af34d3029021
  • SSDEEP 12288:+zVMvvjpkDaBs/aoGIFPfm86tIRAKz655V5XYbh6a+v9u9orREc99p6LnKQPxB:qMnFTanu86tRKCH5Hfv9pREct6rKQJB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2