Extracted

Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.103.32418.exe

  • Size

    896KB

  • MD5

    4d32a5c55202913c93b58d6bdde3ceed

  • SHA1

    cb1179bc185b78f9828a15b779ab65c345b5f370

  • SHA256

    d206e7098a885c65f0b56b34169d9599ce70c09d81439571e3d13f309305142a

  • SHA512

    2a5c952f0e505eef341f1e69cd5d2100ee05f6171330f22352be470350d77571a7ee511e4d48e127893ee03b01353d89b2a7f602ebb717d4c21411b2d5ed1755

  • SSDEEP

    12288:uid+fLgkaGPugBDKSWKGOoirbnhsGpkEukeg28dWkRqhP7ZwPrsx:cvaxkDKS3PrbhskkEuk284OKF0A

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2