Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.28032.25470.exe
  • Size 619KB
  • SHA256 2139944dcc75ffd2ae23cf50fb751ebec4dffb7774764e8b4d48808f0925aedd
  • MD5 668e1b4df3690797f45e3fa3018e6461
  • SHA1 394ea1b76befb440e22ef9656ca170cdab59b6d3
  • SHA512 118df4510d46321c4f3ebaf0b02dd75ca98ee6b6835209ad645bdb90e2d74d8b1a5a7190c3e9bc2cf590b8da343348564b21f79d61e82f68022f51ff5fe29140
  • SSDEEP 12288:1hkqtaT70iTsF9A81P1e3KwgFcFg1yGEbfYOkshhKwCH1:HtXimj19ahpuyGEYxAKwCH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2