Extracted

• • Target

    71de80b8be288dc8fc82ddccaa03ef563d5d29657515457b91ea034707957306

  • Size

    360KB

  • MD5

    25f71fd57ca78398397a7853b666520b

  • SHA1

    57ac40474eb0c25145e13f35fa0b85ae21413aee

  • SHA256

    71de80b8be288dc8fc82ddccaa03ef563d5d29657515457b91ea034707957306

  • SHA512

    7c0a894c137dbfe75f4f4dcea4459b5b758d36852e4d5d497f589c03e9ea9b99e9e122c66ad57920ccb88930c5e5a219098e571a6197856abfd74ed54b60ac4f

  • SSDEEP

    6144:g0p+1doTxzJqITC8amHavXvdXpMZ3hETk7m58cqVdwLjm6Z7UzziIDt2bnFZ31z:d8doFz8r7vdXpMZhS2I8JyUzzh+Z3h

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2