Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.26391.27385.exe
  • Size 670KB
  • SHA256 af869e0c2e147216c4bdc3ab8d27932722ed1beb43ea5f2b362eade332096a65
  • MD5 50b17911cb3eb8158cfdbde108b36872
  • SHA1 797877b3405580841cc636273efaca1d9fe20d46
  • SHA512 3b6804ef8ffc767c0ca5eeb484551be1f6340a732fd72bbaf799d3e8981462709a44875a73b6c9208bfbce7e0264ae11f60d334df551b1bfb1925a0302d7fec1
  • SSDEEP 12288:xPuYd+V6b1momPZefbMZ8O0mD8Vpce1xRxoxS+LiX3g65BXVsPuYd+V6b:xPuYd+V6bIomxib/Orgwe7Gc3galqPuI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2