Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.10999.3561.exe
  • Size 1.0MB
  • SHA256 6fe52fd2451d2b709af8014f26efb9413faa96889393484d413016c7d9b592e5
  • MD5 0193da140b8ff5bf52e36d20a4691398
  • SHA1 ad19c3dd8f7cc12e86753aaac1503647d8630b86
  • SHA512 003aea08e3cd35a439ac989671a3ba2b90812b64bf659a98cb7e421b044e800abb634d3adccb3b1af687143897580b51d39b4ed8f556240fb731997c59605c77
  • SSDEEP 24576:uJPP1yJvh3QzV1X2P4IwV4g6CyN/7Q2mZQYOLE:uJ31OGzTX2P4IwV36THoQYOw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2