Extracted

• • Target

    5ea4437df5dcc07b35c3959a6fc54d07415d77a659f277fd73f34cccfbbfe1ad

  • Size

    837KB

  • MD5

    75dc78c375dfee9c0b96fa476bcd5d1c

  • SHA1

    2f61518b7b14b35b9e4fc53c99455c9d2293f139

  • SHA256

    5ea4437df5dcc07b35c3959a6fc54d07415d77a659f277fd73f34cccfbbfe1ad

  • SHA512

    81673ab01120f7d15675852b4cf3ed020be1d1bc8494d9dac213d33324cd22cfe22652fcd85da06e438c8494fcd19b1e638805651b5412a83ab9912d48015edb

  • SSDEEP

    12288:yZ9pzkL1KcPt7sOcflZDLpp8jlMVGdAbNASR8OA10aIkiU:yZ9pzUH7ZEdv8JMVGdGAS210aIki

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2