Extracted

• • Target
    SecuriteInfo.com.Win32.TrojanX-gen.28883.16875.exe
  • Size 876KB
  • SHA256 3d0816e876a59f4e3b56bd2105122ef69499f79bab375b0956716494eb286dbd
  • MD5 6292cdf074922601a8f882921ca08c69
  • SHA1 9162e9e76e014575f675ac989e7a3f6101d8dc57
  • SHA512 46957c73b9d950122ac2c00cf94edc16d1a7f0f2c887e25d81969d6b167fe16d1abd4e2d25624f8c5496aa19da35dc51c8f19ad0d9433fdfd877122baee244f0
  • SSDEEP 24576:fQYqtm8OqKuQ2AHokZ1Rely+0BbSILMv3+FlYILz:Y+8OgFALvRd+/mMvuX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2