Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.16422.654.exe

  • Size

    835KB

  • MD5

    eca94049fb52ae5b3c06a42e5c57e7ba

  • SHA1

    9c886e9c7e829d2aa2581f12322a62edfb68b513

  • SHA256

    4dd83a9f2b7002a9e6e98ce6035a077e3f379722429211c87c2ced4e708c2473

  • SHA512

    faea351122767b05f462ed45bc3091fa2fea5937e3b2f95bfa9a4823f0837c3de1a1af20a0f5946032cac6a7a691f43ba60bd097cfa1432f2761c3be3ea22db4

  • SSDEEP

    12288:53+sVxv8DshqGPtdUAOYFUzghI1+5NGeKHJQLvtiAdj6pg4DUfGDNDAQNk:p8DsPl9LUzgH3GKLvIyj4vAfCqQN

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2