Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.2390.1404.exe

  • Size

    1.0MB

  • MD5

    6e8bfdd8bdf872045eaa4c65f6aaaa1e

  • SHA1

    22bfe626ca95c802ac0ef66feadba8e1c9d4be7f

  • SHA256

    b31a20d6df03ad8443ab20d92364c49ef473e580eeb5abd6e7bee9fdf8dccace

  • SHA512

    2ddaaa88c4e09842f72a1cbff3bf1f2a7d93321d3ebcefa9abf1c111d4813f99920486c335c1a4bc0802deacf7e0ea34a414863aa127ee904437f09a62ac0cee

  • SSDEEP

    12288:6JsIc8BBtnm3n0He9DlpzIpk1qaxbxQxkT4/rJw8flwykcnM9lPuTO47QpilQP/L:W65X3+YI78p+88W3I3Brps/

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2