Extracted

Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.27978.18935.exe

  • Size

    1.1MB

  • MD5

    2251b26b3bde548b3b1196d875d85127

  • SHA1

    37b29696d5382d65c652ad10bf2b0867a59943c3

  • SHA256

    e2d06e9e6fb4bff6de858e6589e3b8f068e4064372a09093f28165f3da48e0a7

  • SHA512

    43a213b77683b64d767f984e91c2a8c6a37cd15d4a5edb854e8b053c11ba5eb7be42730e4dec182230c065051316fb7741ce3c9d5cfa3c195c1f01e35675549b

  • SSDEEP

    24576:cyGuqdOFWyxSR1SckDKYlvwCZtrAX9TbS4Fs:suqdOFls1Pk2Ore9Tbp

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2