Extracted

• • Target
    SecuriteInfo.com.Win32.DropperX-gen.15338.exe
  • Size 240KB
  • SHA256 b8df5dd15d2bb8b3201cd4d3de86f6e8f0458a1fcc1939788ba38b99e7a219dc
  • MD5 1577b0f5557db2eebfaa8eff445e7910
  • SHA1 faf3f2e94a6699321433d67c4674a3f1d0840604
  • SHA512 37c847d8ba0360a525d1930a8c2fe5e6c9fb2dac475cc633b2628aec3aa602a7585862c2f6c864e34c040108d05af14ca73b7c4768497e8e088c44588adee480
  • SSDEEP 768:ZJ0mVZIsf6VsB9VDgiX93JpjfxZ7QuaAL4CQANObhT0zReFD8K5M69m7zooCqWET:ZDZIW6aBjUiv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2