Extracted

Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.15705.12320.exe

  • Size

    749KB

  • MD5

    33a57e36b93588f026574b4a3f748443

  • SHA1

    5b29dc2969a512aaf8ecef5bae9c10ab1c9ca571

  • SHA256

    75c96c8d4e720fe1290200707fcca94188b4525dcc8ae2f1dfe49068b7bb3e83

  • SHA512

    e27f4d3a7cf32b4e9be21f1fdc79a25e3318bebb77cae1274281bf26067b15641223c14b4cf67e2af1b6bd5b7f5a57eb9dd384eb6a8219ffb5b3f102928290ae

  • SSDEEP

    12288:ca0NBK+gv85YJ25t9WA02qgwx5zZZ4mIPlcx4Cv1/BBs0i/7rhLl:z0NDAJmh02qgwxzZ4sXBs0IF

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2