Extracted

Extracted

• • Target

    68e433364bc17a5e82a50d8cb9340744972ebb6af93352d6247ae2d7a22a1852

  • Size

    239KB

  • MD5

    d7db9c6389c472db5dc849bce28f14fe

  • SHA1

    cdd4e1637aab74c4f35e382f36435753cd3020e9

  • SHA256

    68e433364bc17a5e82a50d8cb9340744972ebb6af93352d6247ae2d7a22a1852

  • SHA512

    8ffe3bcc826d1156f301b7bb054a3c387af5f9c23fdfe750422949c0b8b88c7bfec2ac785925395df2fff40126b295a36612a28ea3ea4c5ab52f16d3d86d8225

  • SSDEEP

    3072:FCfenf3f3PpAkOwbIWjLhmFFnhg5jW0JHnv3+:kfenf3f3PpAkOwbBjLhc5hB0x

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2