Extracted

• • Target
    5ea5ec85c70e7e5486f8f01955c24d0246fd6002a3241bb3f7facf096e0c0d7f
  • Size 654KB
  • SHA256 5ea5ec85c70e7e5486f8f01955c24d0246fd6002a3241bb3f7facf096e0c0d7f
  • MD5 f2ba7ac96a10205eea358a5de0380ac3
  • SHA1 e766f19c47ccee70a8f22dbed6d446f5d6993b66
  • SHA512 1d1ba2e3fff89dcddb4eda9357c8ccad8046e188e6a8251914f2ea4fce4de29b8b29de7aa7c180b103f9e78523335f3e1f29773a8542085a2b14f88a40260305
  • SSDEEP 12288:QcGBkf7qcSRcTXD7TMg6qJpw8ayhtKtrvgT33PpbQ82cvSfrkNvX:zb7hqcjD7Ttb+8/0tqpbQ82cvkrkNvX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2