Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.12076.29373.exe
  • Size 905KB
  • SHA256 dcef69c94d8166b5bd96de0c8b5cc686bc3ec021c7754b43900a50a7913e0a9b
  • MD5 46b8e71ffb2b319226d2c39378f5025c
  • SHA1 61c654b6c4e53b0a4c20ff1b33634dc983b490d2
  • SHA512 f79d2611a586e27224d8fdf55009212c5891626832f5307ee0849df972003aafc73b7d331302134afdb93c08c6eae3be993a9ef1d187aa5654a5d1c8042d2658
  • SSDEEP 24576:3v4qWY9Vm7NHVSwceeo6MlUQBnEzH9cx:QqWV7NHpcpMld1c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2