Extracted

• • Target
    91b85bc8af5080a6900fac25e232068764808aa3f3bf3b2eb23666ab3a7935e1.exe
  • Size 168KB
  • SHA256 91b85bc8af5080a6900fac25e232068764808aa3f3bf3b2eb23666ab3a7935e1
  • MD5 b6b1a1ec4a942a3c6daab1ea6fd8953c
  • SHA1 61d8d6d42a8ff073e85b45acaa28b925a6b14c26
  • SHA512 e9560b3758edc5afa27f67f2d442b46eeea85277cfce80320c15a1b377defb2bb09e0691a73aa1c3ed285247b504d9b818a043ca97ef64172850a0a1f1f7c0d8
  • SSDEEP 3072:j7k55nrZ1oOWVg7nD4PRnUoiwFW0+Wm4swgHev:c5NXoOWVgbkBUgFW0+Wlc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2