Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.26378.exe
  • Size 1.2MB
  • SHA256 fb5699f9385bb3eb377d898e906910579fcea1165ec6c189d37a310da4e079d0
  • MD5 d3a2f00497e83876bb2eaed275877bf5
  • SHA1 e0fa373ec14b0f3e43e12343c4c21488a2263714
  • SHA512 3b596f5ad0bc4ebde76b179d44644dc11514a7bc2b0ae42df313561a839643b9b97e84b7a3563b57ba1e4709f2b4e94bb710bdc031fd316dbaaf2a4fe476f450
  • SSDEEP 24576:te2nG5/zcG/Ul24IGdpPztUQXdaOzkB6p:DIP/n/KPRUClzkB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2