Extracted

Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.24048.16406.exe
  • Size 688KB
  • SHA256 ff939a5a3ccca65092f55808e05edec69e6db26df74db1b743cdc96f4c872279
  • MD5 1f166bede91bdf96650ec5ceb2e6787b
  • SHA1 13fcfdd4e9e20768fe2b405fb7e198ce967e94cb
  • SHA512 d0c532580f7c889b31312a06ed7f3cc51b150f52557473e19cbd0df72b021a5a12afba6313dcdd5629b01319bdac17aaa29ca8808ba164310c46a21f6b95ebe3
  • SSDEEP 12288:RG59AO82u/ZSi1RMcquqCg4G0DLtGAUuxtiraSvzK26AgzutR:RWd82crqCg/0DdUuXirFzf6vzutR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2