Extracted

• • Target

    SecuriteInfo.com.Win64.Evo-gen.22967.30416.exe

  • Size

    479KB

  • MD5

    2406134c26710d9cbd8a23f7dab65d19

  • SHA1

    6c7568146f472a366f33ac8e96a05693b8dd1a74

  • SHA256

    3f2ed14209d2cd6eb55501035e8e826963552ea1bf144caf94fcfd68d1b50c61

  • SHA512

    240def0da376597499254ba564a11105034be31521c89a60e3304b30915e8ecd527d8ef546336585a6c3143e8ca9d9c290bb209a89881f4e457d8df1c958f020

  • SSDEEP

    6144:wVq6Yi1QlYbqY00eu0XcSmYFevvW21QMHbxBMHnvU1D7OOP7NVZjrfQDS96hf+U8:AFLfcTcnW2Z9b1HOOP7Rr6hGU/E1U

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Sets service image path in registry

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2