Extracted

• • Target

    SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe

  • Size

    929KB

  • MD5

    f64f729e0ba974c578afaac25665e067

  • SHA1

    d1225322fd5f16eb18a90ec4a4b007a010e2d51a

  • SHA256

    680f16527c5dc7e7e32bb27b99dcbc85c75282d853cb9a27c186963dae883d2e

  • SHA512

    6bf0f4a2567736cdfa5e422e23f1f43a593699a1276654264a619e2f1b4690af911e04508d0928c3a84ea658c022dc4b44f4f0467254c72bb92191e212e029c8

  • SSDEEP

    12288:kBuqU+PCH5W8IgKprPRibKTh6SoqZpK3tUjjAK7nYbSuSmFbWNHrDdzoa1cfN:Idrlf6SoqbK3InYUJDdEPf

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2