Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.6625.13261.exe

  • Size

    722KB

  • MD5

    9b64659adededa27a78b8f240cbd0e5f

  • SHA1

    21da1258dda97d536a9e8d051643e6dcd1fbc7c9

  • SHA256

    81ebcb6feaa866f8adec0b03dd35a0fb3ceea2882f532c20e7b6e4534dfad5e3

  • SHA512

    de91874d50dfd6d300a07444d22fffbb0f5476fae8eba572e0f8eac5c9e9ed360719e9954d8154d2972e7ec92abdc575c7525dbb108d0ae8494cc62f668362d0

  • SSDEEP

    12288:/8axkEP/SJaliERczSao9geg+HJpnpHjHKG+zqpPcFXdQt:/v/4OSSao9QkVpDtFPsdQt

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2