Extracted

• • Target

    SecuriteInfo.com.Win32.TrojanX-gen.10323.31552.exe

  • Size

    816KB

  • MD5

    d553d284c0f6e0fe58b594d4cd5490a4

  • SHA1

    4ffb4034acb76f294f7905a7c56645dc9b806ff2

  • SHA256

    705322479931288652d8dcca3391e35ec17f003f68085455d8f6e2acec7dd2f7

  • SHA512

    ac7241954b8fb9c4dd99edf539aee2bb91e01cea38066a0598fade96af7104ddd3390d3288dea135264248b904eb9df18862668ca577cea7939d50a313497f0c

  • SSDEEP

    12288:vBof5JhauWGMcgFWTQUwpM3eBjjyTQC6YfsHnoFhlwQGefXcO4Xln:KhJheGMtxK3eBj+TbDsHnSEFr11

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2