Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.9590.31775.exe
  • Size 784KB
  • SHA256 257ba93dab8da864d90c650cfd8b28bd5df50817f574febd5ae102648c5abf1c
  • MD5 c15fa1fd4cc388e45267b4763205a134
  • SHA1 5ed680ca447cbe6a3a46853537c5efc527f66ff2
  • SHA512 0c4c81d55fe8199b9054dfa9574108079a381423997d455e20a63e20f5afb46da8f118e979b75ff5ee81f0ccc0e91bb9c53abccc9f213f2ec6b862163e7816b4
  • SSDEEP 12288:1lKnu3EXqXdVn7uRSOW0Qlb0m5SbYz3aZgXrHNHzBhaUnLo1VawAeO:iK4qXdV7uRpQlF5bOgbHNBV4VawAeO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2