Extracted

• • Target

    SecuriteInfo.com.Win32.CrypterX-gen.17640.5876.exe

  • Size

    707KB

  • MD5

    7ee98e9c019067c1dfda71c8a92ce58a

  • SHA1

    07bde0c81f43a911ae2629818009330e01f241ba

  • SHA256

    ccfe18e731f5ae4678feb7154097e80ef78905f861d3eb207040f4319f783ef6

  • SHA512

    eff358759dcdab5e09bfb7461be38261e7b89c87fc6a9103b7183af74a9270e12f863d6062cb61703e45e3a8341121f691036268e6abf0c4933bff11f32f6807

  • SSDEEP

    12288:Y5pd7BR6wT9UV9W/5UqEXAt9ICXvR2sAktYvj5D6RmKeDoi0EZSmZvEnfMOonaZa:spBeL4tEQt9d52OavE7i0EjZvLCk+47

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2