Extracted

• • Target

    SecuriteInfo.com.Win32.BackdoorX-gen.12421.31562.exe

  • Size

    719KB

  • MD5

    00ab6febe79c20a86686ee02b2fc08d9

  • SHA1

    e7c80d9b39b200561a03396cb6ce7c7eea14a3bf

  • SHA256

    91eced3c8d7c5ae55c5f9efa5cf214ce6a0deacf6dd257613780a20f524cc2b6

  • SHA512

    6a9b10842ca860dd71727f37ad1031526b454350fb6ebb5b3950079a21f6dea5d5d92d9fd781857bd65f067b6af94b7fd0442d11eca3eb8715338a2e63003645

  • SSDEEP

    12288:eA5WIPr4zzlD/y8L7Fe2w0/GfOyDDLUkHWoPRRf/FQMt1VRV5fIEnkIgeK0fSvL:eu874U/GG89RQERnfDkITfSz

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2