Extracted

Extracted

• • Target

    SecuriteInfo.com.Win32.RATX-gen.26533.9243.exe

  • Size

    665KB

  • MD5

    f8386a9d4a69ae5af9d907411b09d117

  • SHA1

    000110cf3ba7402e20ff49c0a71d0f028d5bc532

  • SHA256

    2e62ccab66721d06ed86a11e1fb8e2207f440529a148efcb866b29f2382d12c3

  • SHA512

    03e219062255de66ae75ae646127630f536c24411cbd8b18e7fe87033be86b7bee2296890a78e305279270f0033efb33b6531f04aa1d2c9c567d8b69128808a9

  • SSDEEP

    12288:k1Xi0C0eEnPRodr19cRdSysNtn65BPpV1cK0Lnq8nloGkamiPk:L0/PSdr1mH/sL63PD14LnqENm

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2