Extracted

Extracted

• • Target
    f1334baff5883873972426ecbbf2de04cf68608991b709365d0b9d556ce7c8a4
  • Size 790KB
  • SHA256 f1334baff5883873972426ecbbf2de04cf68608991b709365d0b9d556ce7c8a4
  • MD5 9e1deb6098c93c48c5d037622c624dbf
  • SHA1 6b5f6b757fcf644156b87768532d75bc5c1fa516
  • SHA512 253a3e5abbc55432c49366ca170e4e6550d255dcc2f5a97c3948a3af5772eefe0af020b8d014344cd87e44db98bc24d7882a812705e9d3a7697bfd19832c895f
  • SSDEEP 24576:mW7C3c6AeVgXlFObhzq+AlodMteXC4TcgtY+VTPC:mGpUgqNzFUIXqgtY+VTP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2