Extracted

Extracted

• • Target
    0b65fb604be623f2ec533d1ffce65badb705ece87d1ccebf23b6392df1edfdc8
  • Size 365KB
  • SHA256 0b65fb604be623f2ec533d1ffce65badb705ece87d1ccebf23b6392df1edfdc8
  • MD5 7bfbbdad130544ad04cda662c8be44bd
  • SHA1 b41d37673df66b3226f282b45347f5795b5af3c2
  • SHA512 32540c1bf15fb4e3b7682309d6b72f1ee419da8f34b2c341a0fd8ae70519bd5f53b8791ea751f8e2f29918e30e37929fead8b68b19282c60141f2ff8cf07ab57
  • SSDEEP 6144:ifIRJP/kHsfne8GCUDKgbm6T2LvRbV9kThEyKWpP0rpqs:kIz/kMPe8GCvim3t6EyO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2