Extracted

Extracted

• • Target
    16a6f4aa6b5903eea3231280466646faac0dfa10f4907ba3a35248f019760aae
  • Size 2.2MB
  • SHA256 16a6f4aa6b5903eea3231280466646faac0dfa10f4907ba3a35248f019760aae
  • MD5 966eb156673c5494505756cae48aef30
  • SHA1 5c7fed81ac78755e0126575f417e278d6e16e72a
  • SHA512 fcbbd91efde3e829ae5c67acd8c63da830a947faf229bfd72c5ec181abc89d7355b1a088039d579707d06050d1236669f35fd7447dd43129f20cb40b0b472df3
  • SSDEEP 49152:j8g3CG/MC8e+6lj/QyMgQbCJ3cfq1KvrDuAm76DGepTTdyJ:Qg3CiB8e3jSgQbQc9dmmJpTTdyJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslapurelogstealerkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer

  • PureLog Stealer payload

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2