Extracted

Extracted

• • Target

    654dd69ba0d5b097f247d9794968338170d37220aec7591974134f6e26099b56

  • Size

    1024KB

  • MD5

    627490168354aa619908bc3cb28f5986

  • SHA1

    03c62bfb5df5f5d3202d612d0213aa06a505ffeb

  • SHA256

    654dd69ba0d5b097f247d9794968338170d37220aec7591974134f6e26099b56

  • SHA512

    508f8e1ca55f99aa06e77268f96863347eb5c81dcde907c488040e7f469e8ce2e25d23efb3c4729f76aa753a7b2125606e3c3f4cf87edfe84f41b465bc1fe118

  • SSDEEP

    12288:a+DrrTD8GenC6V3aKuNUrt+beP9wg1y3anFToKzggSHdHBBJhpD8iZJgKk9495tU:pDrrTD8XaKux8O8Wr/bLgKk9X

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2