Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.29414.12459.exe
  • Size 790KB
  • SHA256 8cee802d5d7b59d30d7df040ba114ffae58b38ef2aa4506b96054d810e603f04
  • MD5 fde010382d125461dcacc0bf520c01c9
  • SHA1 ccf028abe1a5fb2f49cb35054115bda53f5206fc
  • SHA512 17a0b4330cc19d2a7e3dc77556095cda3dfbb5b20299b8c940469f3c32e2021a4067accabe90b72d57dcb68f3c1d895e7c8bc905a53aea72987256a67484c7b5
  • SSDEEP 24576:LdGUQt5zxEz3N0zRgU9vATRegVpYz4Mfo68bshN:Zjum3N0zRgU9vAcm440abi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2