Extracted

Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.13615.9335.exe

  • Size

    1.0MB

  • MD5

    86881f4ba22d5c07b6e30821c92ce817

  • SHA1

    68a5f0d7aec9b4f40970ec682cb1d24cbbbe20db

  • SHA256

    8e520f1ecc9ee00de91d22b0b66dcd59023efa5c8d89812801c36e4362b32539

  • SHA512

    292c8a9bca7ac188e0a0173421cc8e917837de00c44723172ae88c85475c66ec2a3815ab799588e8cb3bbceca09b887be85644acd53dc44982155d0764c8a0c1

  • SSDEEP

    12288:iTTYsZ1DX/VDJtV77ebeSf2riFR/6+JEKFvNVIQGEPGimCW9BTJfjhFfzcfY:eTYkHebzf3h6+GKF/jGRVjnH

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2