Extracted

Extracted

• • Target

    e6f50a0c2551c1d2593b8963bac95b0a3f4aad6d6b60d2a4e09d0c70dfd37649.exe

  • Size

    584KB

  • MD5

    5d32495cf3af0094a17aa09f76b7d27c

  • SHA1

    3009c98452cd000828b3bf0ba8ad5b72d05c7f7e

  • SHA256

    e6f50a0c2551c1d2593b8963bac95b0a3f4aad6d6b60d2a4e09d0c70dfd37649

  • SHA512

    afa9331ef7fdf6b261b1a1164af17ab52fccb3f24ff659bd6242bf01ba210989bf326e4ba0141cdbb994f0759061f87e498a86fad7d77d566aa26dfcad35ebc1

  • SSDEEP

    12288:7O7LcE7rjYvGrCLXBozBd6bRMgvChOW1AsQ6nBhhdBrGZ:ZEcu29ozBUVMgvNW1AsQOfRG

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2