Extracted

• • Target

    EKRTLpU5icGiWtr.exe

  • Size

    724KB

  • MD5

    004d30b863f6438adde6cac38306e649

  • SHA1

    ada01df796179f911c779887de1bbc5003ecb124

  • SHA256

    e8a2290e74f358ee05881b5b74b62710e76a89ad95a23a5925687c6faf4b2de9

  • SHA512

    25af44c77804674bc218986a9ed53f3c71348478cd904f568a782a15964ec174231cbd023ef2071e4140c03d0079833dfc74194f32d9200398e68d1706999937

  • SSDEEP

    12288:PsRlDYSrRoaJKOErvezIpuE1Qd/7+bGdBpn6IpkuHDV0bRY6SThE+6MUFLv0APf7:wSSrSMWrvxpLQN+bGhn5pJp0bRY6SThx

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2