Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.1744.28457.exe
  • Size 7KB
  • SHA256 9e70f94c2bee83c63e40004e38b390edf044b64e5ab5554f3aad9dd187e23d6d
  • MD5 4e5f076002ebdfb9896f3a4715b847a7
  • SHA1 aff7f26402a75c97c32a2a96bb327ab21e734875
  • SHA512 ffbdc46c42170c9d501aeac686f74a6c8487533454bcf639472f121588355b57460b7abf6040cbe19b788f0ef6277195012c2e3d1418cacc0fd0149547eb3b27
  • SSDEEP 192:56AdigimZEzLXv2JWgLdLCLghruoFfUt:MAFzEzLXuJWgLdLCLejfU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2