Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.4085.9395.exe
  • Size 673KB
  • SHA256 24d29087cd9eeec19d7ccd087f2a7d6bb33a1c8cad5519b6e399235e7d1f39b7
  • MD5 410e187db30108a114d08cf587f7bcb6
  • SHA1 1f9d3ca98752e68bd957848dab90b2e6e5d9cc0f
  • SHA512 fbd9ae526cab7a46eee5c50ee7688f63c34cbcb7b5727e8eeb707f9603e9e34a4121a597c035923bdbfcd40d63385b35cb436b2832fcdc1915fa1f005073d99f
  • SSDEEP 12288:AiD29xlub26F8NZXF+4o8DBXGEF7InAc2dQSv6+CwMjpsAV:OPw248NVFJEVAc2dQF/zH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2