Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.1019.32361.exe
  • Size 932KB
  • SHA256 cf7d6cbc7a96896a60640f293bb9e3aad591556cbffdab459b2e52f89f89865e
  • MD5 d68228fbd8bccfd3305cf1349d5e4c22
  • SHA1 285c70803d606cc3878ae1479bfb116a3ae7e232
  • SHA512 ace28113b6da634afa9beb98b550a77ad561bec6c0bb755f5f7b5c0c1840cd7f9e0525856844dc45fabbf37b7b8e4b5871a9ddb2a7c9eb5ac828d8b9c728439a
  • SSDEEP 12288:M8JxMYtLvJuiGQI5zGMLK9rkt9WDp1IPySFtTNDfizc:pJ/pAFzGM0MiIZFtTNDf0c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2