Extracted

• • Target
    SecuriteInfo.com.Win32.MalwareX-gen.15220.7463.exe
  • Size 1.1MB
  • SHA256 f71c34128bf5c4a4ecc05e5aa4fbd02740b96c4aaf075124f3a4e33f36c17c92
  • MD5 7714e94a0d99c9684ffc81cbcac31d78
  • SHA1 f85d1d2c39889f9f9666e3783e87ad52689373dc
  • SHA512 3fbb548d08033f0b0f8eacb07f133f83f29cdb0efe990f24a5c5f0a4fce28f764ee7a3b48fe74c9a794082e010302ff50a05b6422c3e6484668a7075c1598f2e
  • SSDEEP 24576:inxn33mbv3OzHxv5D64aD/6FNgmWcMSkLBfJXAPUGlDH23nI:ix32bv3AR56D/6FNgvSCBfJXAnlDH24
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2