Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.22479.27738.exe
  • Size 1.1MB
  • SHA256 cd67c3ed0868cd0d281823843bfef2c094a198e0dac59e1dc5bfdfecce3e918b
  • MD5 c0bf2d579b7b1069da0c520038babcd3
  • SHA1 75013dcd48df570344cd29df4bc468072d5ffb5b
  • SHA512 e55e6458102ec7269df43cd2aafc15a9f8604620cc0278bc13f5a94fcd4371b008162224af31b1bbab50c95e0c704fdcddc4d5643cb11b08176c3d5b11218717
  • SSDEEP 24576:li7RqlKIkm9nCalDtO8HjDcFKXt5w+mak/:Y7Rk9salDtFD0K9qJR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2