Extracted

• • Target

    8c50793cf87fdebbc09e34a75a0b4a979eb36ac62a36d45b3aa1954f189766b1

  • Size

    636KB

  • MD5

    899adc619d8890021674e798c260a475

  • SHA1

    777a050031f9823b3d7dcec960e99b03ea073ae4

  • SHA256

    8c50793cf87fdebbc09e34a75a0b4a979eb36ac62a36d45b3aa1954f189766b1

  • SHA512

    89317b73dcd3e3f1255c53f826182aa2affd73d7fe88ab580bae9f88eb36fc4f3a343b6bf4084595a46c255499e553d8e8b46557a82e0861e1588657f8100300

  • SSDEEP

    12288:xa5WrPR+iLp7HeiWiWB6HPwSX676nC5fzfgAC5ZLDUDmOP1sApBRc/6h3e0O9Osj:DT8gpTByB6vwSdnOfzfWRUh1X1DO96

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2