Extracted

Extracted

• • Target

    829f94ffd9569368a26ef7d515907084a9f4f5a2876b7f5928e75976a06a9574

  • Size

    752KB

  • MD5

    1358776bb4bbaf4d48093571d336d33e

  • SHA1

    d805ae684052dc76a97f63ec8a747a8b487c04ab

  • SHA256

    829f94ffd9569368a26ef7d515907084a9f4f5a2876b7f5928e75976a06a9574

  • SHA512

    e2d6bb79fb76c90838b471f3e75308cf3dc73c2efc970378eac7262f7d5e4a4a3f223bac5f19e365b77a37f5cd4bd83d4462b27f2922673d29e4b828ecc72e43

  • SSDEEP

    12288:1VK/pbM2+MqX7IS2g2RLIw5AuK6iNW83S/LZXT+ZaYN6ypJ89z00ZQYeI2y/HRwZ:1ViM2+rM9RLIw5AdNWzLZD+n8x00ZEI8

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2