Extracted

Extracted

• • Target
    9ad6de4091e39f9039c6ad69c60c03a0_NeikiAnalytics.exe
  • Size 245KB
  • SHA256 0950f0881e56e1e5cb96ccd78e7d0034618c9341e7ff320e28bebd444a012838
  • MD5 9ad6de4091e39f9039c6ad69c60c03a0
  • SHA1 d8cfec91fc548568059d063eb22ca040b2c2610c
  • SHA512 4350e2a0aa55f67d39a6b4763909cae782e571fae5cc325f52efe00499598b012c6ff1b3f3b84fdb7fe727de377798a6cb6d6da760c662a328608e3494e36f23
  • SSDEEP 3072:uO3Qk40QeATrlLgdJRHvrtNa/Pyb59yfdTR:uqQk40QeATrlLg7Na/Py6fN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2