Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.10615.22905.exe
  • Size 754KB
  • SHA256 f8cadf28d331fb0af9d2b53cca0859948cb5ab2e5f2e447c6659f481e73c7a77
  • MD5 ddd6d0dc48df1322bc34c4e3ef571c2f
  • SHA1 043212150ea775931ecd5f0c0903652c0abeea4f
  • SHA512 b132770bfa52b2bb2c9bb727acab754b15b2e2868bc2b15a4fa228c36269907ee7ac7da071dcd4b65fbfbe4b110d00998451cf7be6b236e842d54a4cfee896a9
  • SSDEEP 12288:xxq99hXfjCoX/rL7wtsS4HiWbja/WWhqwKAH0eBnM33302IgFJN0V3foocjZnbCx:bqZvjCS7GebjdWhHKEBnG30YCoxjZnbI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2