Extracted

Extracted

• • Target

    #568350035791.exe

  • Size

    770KB

  • MD5

    63afe391178cb8bf14d24d2d569dbc51

  • SHA1

    477c0cea3777ec0e4e98eba78dd81b72f12af8f4

  • SHA256

    2fa2f6f81dc805b509157ff73570ef9fd921cc0b73bece828000356c926546a6

  • SHA512

    0beea59ffb0e56eb7c926cb125944c43d753788cce9a0b0ff43e78c14e689c330349e372f28df0366e52af044c397335f8889f755e59c0a7380496009ccbec6b

  • SSDEEP

    12288:Wp2IEA/HPL374emD+biF/cQ5zLYsC+1BViX1j4bSVlxVlIi014bFZsyWFcw:OPDdmDZ/cQ91pBViFjXlN9FZsy6cw

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2