Extracted

• • Target

    65808985955d6c5df16a4679a0fca5437ab7b2a07eb55c240de1b8d22ae3b8c3.ps1

  • Size

    384KB

  • MD5

    5c540d4108cce10839d48d7a8ba97c11

  • SHA1

    cf410d7dfe50cbebec376464968a1a6035f778f1

  • SHA256

    65808985955d6c5df16a4679a0fca5437ab7b2a07eb55c240de1b8d22ae3b8c3

  • SHA512

    7098674e66ab8761e37f2aa4382e0bdb363605bfea0712b8ef8767809d1baae03ff97023f07e17555a9da09162260261294b8a63049ac48bc76448f6844b5e0b

  • SSDEEP

    6144:iz/Q0tevGcnK8XXHRSR0aiZd1kHY9LrNi76Dl6WiCAqeHbqg/dz71:A4yApnlXx40rr10sLrQ7W6ZCALqgVP1

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2