Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.24231.18855.exe
  • Size 651KB
  • SHA256 904b3bd6dc96843fa949ece4b33ef83650d2f735f0caac028cd3384e864ef8de
  • MD5 94c52ad40899fc1fc2523927c0cdf022
  • SHA1 c5b1bc6e37dd622625ceeed27d3d331f8f7dd970
  • SHA512 1cdd196ffaf41793bdf41f3ff99d8b0a5a06101c5026e12a299be23ff25389cb68d3d681b6d956d49dd20d773af2bb9a20ec3d98b7921cfef2e16c1b87381678
  • SSDEEP 12288:wLclPloOJRYWqKgS9Pj6gES45VNZlFKbOCdPdPW4vG+W9jnAkgXljkR:aC9oOJbXN9Peg4NZlMdVmn9nAkg12
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2