Extracted

Extracted

• • Target

    ff7fe4adccbf79733798ebd0648ac1eeeae67bd8c9102ce30ad845f80c799c95

  • Size

    740KB

  • MD5

    26090850955e5fb4896e091395c5efab

  • SHA1

    136a24c124b52bcd122b925bee1a13deea5fba84

  • SHA256

    ff7fe4adccbf79733798ebd0648ac1eeeae67bd8c9102ce30ad845f80c799c95

  • SHA512

    fa55e45bca00386b970d821388e68467547ad87682f9b3576b1c78acfa4ce6cce0118ce107472deb5ea21fd52ea6ed6fe6fa70b7c2f9a6fac706a358098589f7

  • SSDEEP

    12288:wB1oVeonDkhJY4GKC3JZj9BPpe1P5KHliLgU0j/YEwxCB2oE9qZA30R+/wIgrXj1:io5+NeZjReJ4H5HD0xS2oEwZA36Ig3Qi

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2