Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.11458.5479.exe
  • Size 948KB
  • SHA256 8d1bff8e45e6e259229503a8fd2ab69b04cf197f3d2e2cf7bc9dd512bac141a3
  • MD5 0eab22a5a2fe2f40003af16c931cdec9
  • SHA1 214cbf1bc5f04f00d5b3a3ecdc6f0263afddda7b
  • SHA512 e18cea112ec427c25f7781efe2471e0714eaa26956e8f9e6575675698a00d441277ccb0eb4b0fa0765e4be8bd37ed00d82a413e41a755c5b46ebb833f8163f69
  • SSDEEP 24576:AHobugh/E0BWdcNy1RSwI2KxCh0bC+jp:jbxh/tWr3/LO40m+jp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2