Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.17533.13867.exe
  • Size 905KB
  • SHA256 539fcce4d58770b81cc10d650f7ef810d9e933ec5901cd051f110d574b2c6868
  • MD5 133841f45fda98eeaa5d5c7a46da5cf3
  • SHA1 f0bc35f5feb7581ac2e7a5704c51e37ec99e181f
  • SHA512 72705067f82867044a6c4b1cd4affdd28497bf118fa1f45aae4add1bac0662069fec3d36a1183287f64e9b8969f50314b03dcdd0247a425c90cabf18b701d578
  • SSDEEP 12288:Pv1Nxy8piWjqqHDxQ6q3kUHKNK7Gkw0W3+CahH6N70kD9c3h:H1NxyiiWZVQFNHKNK7Gkw58H6D9cx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2