Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.3126.exe

  • Size

    819KB

  • MD5

    9b98400e0aee55beb29ac510e4a7dc80

  • SHA1

    477863ae05a0ce1b872295ed75467dc40eda915c

  • SHA256

    b24daaf49366775411cbaafebc8df131f4cb2ebb96e099c085dcd9142c6a8e3a

  • SHA512

    6b0abf839e70a19314076b2c505f3a8e0db849c71407fd73e6692c00401dcdfa67ad8ef5b5b02aaac377c8fa7c8c6974c15ab0fb20ab6937b27029a953abe83f

  • SSDEEP

    12288:fyin3ZluJSybuKqA5ix93z6pralWki6CPdB6Rb1QP0u:lpc73ix93elBlod1Q

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2