Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.17001.22502

  • Size

    633KB

  • MD5

    c0a99a3a4b7fd598b0e187c56b1871f3

  • SHA1

    21f2ebff9fee2e393c75086bc978a9e09bd71623

  • SHA256

    beea0fcc9ece913f4a98c351b86a27976d8c0f42f28b6d7baeab79afb7c7fb93

  • SHA512

    ea8860999e3de6af66c021eef0e43cabef327ddea17d8a172c2ff7b5b54aab1883d2c1776734f21f1c75b72ef6bbd6264580b7636a6eeccd2ff31544f1114af3

  • SSDEEP

    12288:Ae45+po2TEBnz8kbJt7/6gZd2bsBojTwoRxzdMRikDFhMYxVVOD:A9+pJTWzdVt7/6GdcsWjTwUxnwQMVVO

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2