Extracted

• • Target
    079fa14ca79e70e3af541fcb3b7cbc67f4e3ce48321b46ac71df8e63d8ce5da9.exe
  • Size 245KB
  • SHA256 079fa14ca79e70e3af541fcb3b7cbc67f4e3ce48321b46ac71df8e63d8ce5da9
  • MD5 d9d3ab0c8792d0f8e3105b90add9220d
  • SHA1 6fc2ee6e78a45b5eb266cddb00c04d16295236e6
  • SHA512 542a075846f60d3565a64d3dac21988eeec17fc35d48b33e148338a95aebc1181a275e3045f9e65d818fc90b1e1ac436d91ec5bb1a24b759d179a7642db05c82
  • SSDEEP 3072:lXk4UQkbX4TZfRJTA4XIctWICnz5UlJiN5c3+E:Rk4UQkbX4TZfRKgWIgUJi/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2