Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.10063.29954.exe

  • Size

    663KB

  • MD5

    9f3f5773128c8e2fadef3fbbde7514b1

  • SHA1

    9508c5e17fd4ba80bf436e03de7479978d98dd6a

  • SHA256

    b3926ebc03d98c6582644128faa0e34b8c406923d28e83f0190f01c95abc9291

  • SHA512

    78f3172c780c29d206d198cef1df5f29cbcd787fd49df29bbdcd9315c5bf3a5cd942814c29d6bb153717f193e2151746052bf79276ed9eb8cfd3a8bd3e82b867

  • SSDEEP

    12288:ZWWaIvM3zrbETClaaCPP+agD4zrWircyVOoay7NsPGLuszSBsHskFgFwIyXCDD:sWnU376CwaCPP+JiqirCoayyeSsGaskQ

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2