Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.24120.29781.exe
  • Size 418KB
  • SHA256 b5e595f70f317fc0c3916b7f0294681db744ec05ab7013cfb770c1f656018c8e
  • MD5 37b418b14ad3491d55e1e3669838ab69
  • SHA1 67db39a82a7c4c930482ac74dd768d57b9ea990c
  • SHA512 2c578adf598d4d89b9fe2f5cec4649093c671c06c3c8a260f6e8bf789d7bcec5287d458f07effcc2ade4e5c8fb9583a2d68798d685cd4347b15b7cea209b5a3f
  • SSDEEP 6144:jTjPJaPJaHJamfaeCaTq9j10dx5tPNtbusqfIRzmzT9w4KRKIdcZAGiW:LJ8J0J/TqR1MtPb6sqmzmzxeAILZW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2