Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.32302.18886.exe
  • Size 942KB
  • SHA256 dedb50b5fe07672b55fc3cbc497b917ce9cde55ffafa5a855cc42addaee124f7
  • MD5 624bfe5972a3f941fda9e65ea502d6aa
  • SHA1 655dac3f2872c96fd73903db7a5ddc1619319eb8
  • SHA512 e1acc1e819eb80e02cab75b1e7952bc54cb505e75e596b87461f7554af89f40607849a578337f3dc95a7d6e552ba6e0262834e56f072697f4d25cbbd7a29f70f
  • SSDEEP 24576:EXoSZp+EyJlysAhd43xMKmpyijl5cipw:GL7nOlV0dLXpyijr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2