Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.24525.21835.exe

  • Size

    637KB

  • MD5

    721a96d880b077080b92cbffafbfc42a

  • SHA1

    17c5b885f31bfc390981002f8cb51432ddc537f0

  • SHA256

    df10b7d74406ca50860baa1f7b62bbffcbc9b7c66b906c883a0c7ddcbf185d32

  • SHA512

    373505e5c8db3569f02ea008dc3330524118fc745538d6950d933282a92f03421732b627a465848a0d54afe757a532f97b536512bee1f3fff3e227f9aa0cd92c

  • SSDEEP

    12288:GLlUgM4noPCwfUufs5Op0UHUpIPEGWQPh:GLlUgxnoYufs52EG5

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2