Extracted

Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.2313.1743.exe

  • Size

    728KB

  • MD5

    f7007e5d3b1d6c2833ef79b69dfe6542

  • SHA1

    56a20bc9bbf30e0447a25018a91e52972684dd1a

  • SHA256

    84b5e1b2883149321ba59ca2179d8ee2190a5d335cb6f15c5c4285dff78acefa

  • SHA512

    bb8ce4de17c108934ea833adf620853157677ac8404cb07bb5318d91469c394aae116f119e8660f9a2fc30a58b6e4876e05bec710e29f72687fdb32b5a072a80

  • SSDEEP

    12288:sx3ZyS+paz6Y587JJWh3PkNYzk+1VfNzP2ixoxanAib3dYxqpC:sx3Zpaar+7JUJ3R1vqTcYKC

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2