Extracted

Extracted

• • Target

    471e1552c28823dc7f3fe17abde8666e573db5d41b030aa3c46acb92f0aa7512

  • Size

    11KB

  • MD5

    34e104205244cdd76c3420d734066b02

  • SHA1

    8a3e1a2736de563e2f32abe631db0be24e992b16

  • SHA256

    471e1552c28823dc7f3fe17abde8666e573db5d41b030aa3c46acb92f0aa7512

  • SHA512

    f5f37381493da8adb036290927067aefb939544fc52de13c1f116c97b76a139fde07cfa5ed123a4af9a12994abfccd88e9219b6f7b4dc2c021a9fc15bc9c70b0

  • SSDEEP

    96:Yf3HO3KJey0wOmtFHBRl4gYxuT40VYglYdCVzUg4pZOnENiUgzNt:u3OXrenRT40VuwVgg4pZ/N9i

  Score

  10^/10

  purecrypterdownloaderloaderagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2