Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe

Overview

General Information

Sample Name:	SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe
Analysis ID:	756190
MD5:	65cf34490748f7924db84dc043f5d81e
SHA1:	1ea50942d4acf0561bd6bcb3fe0195069eb5c259
SHA256:	96642679196d3f732718eebf2e7970d7eca03ddc4645b3f0292db847ed82b24e
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

May check the online IP address of the machine

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Drops PE files

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe (PID: 5996 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe MD5: 65CF34490748F7924DB84DC043F5D81E)

schtasks.exe (PID: 4572 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IwUNvHNy" /XML "C:\Users\user\AppData\Local\Temp\tmp2885.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe (PID: 532 cmdline: {path} MD5: 65CF34490748F7924DB84DC043F5D81E)

IwUNvHNy.exe (PID: 4664 cmdline: C:\Users\user\AppData\Roaming\IwUNvHNy.exe MD5: 65CF34490748F7924DB84DC043F5D81E)

schtasks.exe (PID: 3236 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IwUNvHNy" /XML "C:\Users\user\AppData\Local\Temp\tmpD8CA.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

IwUNvHNy.exe (PID: 5060 cmdline: {path} MD5: 65CF34490748F7924DB84DC043F5D81E)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.strictfacilityservices.com", "Username": "accounts@strictfacilityservices.com", "Password": "SFS!@#321"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.524293663.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.525739728.0000000003164000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.316510086.00000000041EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.316510086.00000000041EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.316510086.00000000041EC000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x15a83a:$a13: get_DnsResolver 0x190a5a:$a13: get_DnsResolver 0x158f64:$a20: get_LastAccessed 0x18f184:$a20: get_LastAccessed 0x15b247:$a27: set_InternalServerPort 0x191467:$a27: set_InternalServerPort 0x15b590:$a30: set_GuidMasterKey 0x1917b0:$a30: set_GuidMasterKey 0x159076:$a33: get_Clipboard 0x18f296:$a33: get_Clipboard 0x159084:$a34: get_Keyboard 0x18f2a4:$a34: get_Keyboard 0x15a425:$a35: get_ShiftKeyDown 0x190645:$a35: get_ShiftKeyDown 0x15a436:$a36: get_AltKeyDown 0x190656:$a36: get_AltKeyDown 0x159091:$a37: get_Password 0x18f2b1:$a37: get_Password 0x159b80:$a38: get_PasswordHash 0x18fda0:$a38: get_PasswordHash 0x15ac7b:$a39: get_DefaultCredentials
0000000E.00000002.524696684.0000000003111000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000000.305776965.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000000.305776965.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000A.00000000.305776965.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31cca:$a13: get_DnsResolver 0x303f4:$a20: get_LastAccessed 0x326d7:$a27: set_InternalServerPort 0x32a20:$a30: set_GuidMasterKey 0x30506:$a33: get_Clipboard 0x30514:$a34: get_Keyboard 0x318b5:$a35: get_ShiftKeyDown 0x318c6:$a36: get_AltKeyDown 0x30521:$a37: get_Password 0x31010:$a38: get_PasswordHash 0x3210b:$a39: get_DefaultCredentials
0000000A.00000002.525329197.0000000002B54000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe PID: 5996	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe PID: 5996	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe PID: 5996	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x103bec:$a13: get_DnsResolver 0x1029d8:$a20: get_LastAccessed 0x10437d:$a27: set_InternalServerPort 0x104565:$a30: set_GuidMasterKey 0x102ac5:$a33: get_Clipboard 0x102ad3:$a34: get_Keyboard 0x103925:$a35: get_ShiftKeyDown 0x103936:$a36: get_AltKeyDown 0x102ae0:$a37: get_Password 0x10328c:$a38: get_PasswordHash 0x103f08:$a39: get_DefaultCredentials
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe PID: 532	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe PID: 532	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe PID: 532	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x3a6ba:$a13: get_DnsResolver 0x39047:$a20: get_LastAccessed 0x3b076:$a27: set_InternalServerPort 0x3b2f1:$a30: set_GuidMasterKey 0x39142:$a33: get_Clipboard 0x39150:$a34: get_Keyboard 0x3a341:$a35: get_ShiftKeyDown 0x3a352:$a36: get_AltKeyDown 0x3915d:$a37: get_Password 0x39ba5:$a38: get_PasswordHash 0x3aacf:$a39: get_DefaultCredentials
Process Memory Space: IwUNvHNy.exe PID: 5060	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: IwUNvHNy.exe PID: 5060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4314970.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4314970.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4314970.1.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32bcc:$s10: logins 0x3264c:$s11: credential 0x2e906:$g1: get_Clipboard 0x2e914:$g2: get_Keyboard 0x2e921:$g3: get_Password 0x2fca5:$g4: get_CtrlKeyDown 0x2fcb5:$g5: get_ShiftKeyDown 0x2fcc6:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4314970.1.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x300ca:$a13: get_DnsResolver 0x2e7f4:$a20: get_LastAccessed 0x30ad7:$a27: set_InternalServerPort 0x30e20:$a30: set_GuidMasterKey 0x2e906:$a33: get_Clipboard 0x2e914:$a34: get_Keyboard 0x2fcb5:$a35: get_ShiftKeyDown 0x2fcc6:$a36: get_AltKeyDown 0x2e921:$a37: get_Password 0x2f410:$a38: get_PasswordHash 0x3050b:$a39: get_DefaultCredentials
10.0.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.0.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
10.0.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x349cc:$s10: logins 0x3444c:$s11: credential 0x30706:$g1: get_Clipboard 0x30714:$g2: get_Keyboard 0x30721:$g3: get_Password 0x31aa5:$g4: get_CtrlKeyDown 0x31ab5:$g5: get_ShiftKeyDown 0x31ac6:$g6: get_AltKeyDown
10.0.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31eca:$a13: get_DnsResolver 0x305f4:$a20: get_LastAccessed 0x328d7:$a27: set_InternalServerPort 0x32c20:$a30: set_GuidMasterKey 0x30706:$a33: get_Clipboard 0x30714:$a34: get_Keyboard 0x31ab5:$a35: get_ShiftKeyDown 0x31ac6:$a36: get_AltKeyDown 0x30721:$a37: get_Password 0x31210:$a38: get_PasswordHash 0x3230b:$a39: get_DefaultCredentials
11.2.IwUNvHNy.exe.293a138.0.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x27d2c:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x27d70:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x27db8:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x28044:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutuser $true 0x280a8:$s2: Set-MpPreference -DisableArchiveScanning $true 0x28100:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x28158:$s4: Set-MpPreference -DisableScriptScanning $true 0x281a4:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x281e4:$s6: Set-MpPreference -MAPSReporting 0 0x28230:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x28288:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x282d8:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x28328:$s10: Set-MpPreference -SevereThreatDefaultAction 6
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4269b20.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4269b20.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4269b20.2.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xdf81c:$s10: logins 0x115a3c:$s10: logins 0xdf29c:$s11: credential 0x1154bc:$s11: credential 0xdb556:$g1: get_Clipboard 0x111776:$g1: get_Clipboard 0xdb564:$g2: get_Keyboard 0x111784:$g2: get_Keyboard 0xdb571:$g3: get_Password 0x111791:$g3: get_Password 0xdc8f5:$g4: get_CtrlKeyDown 0x112b15:$g4: get_CtrlKeyDown 0xdc905:$g5: get_ShiftKeyDown 0x112b25:$g5: get_ShiftKeyDown 0xdc916:$g6: get_AltKeyDown 0x112b36:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4269b20.2.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xdcd1a:$a13: get_DnsResolver 0x112f3a:$a13: get_DnsResolver 0xdb444:$a20: get_LastAccessed 0x111664:$a20: get_LastAccessed 0xdd727:$a27: set_InternalServerPort 0x113947:$a27: set_InternalServerPort 0xdda70:$a30: set_GuidMasterKey 0x113c90:$a30: set_GuidMasterKey 0xdb556:$a33: get_Clipboard 0x111776:$a33: get_Clipboard 0xdb564:$a34: get_Keyboard 0x111784:$a34: get_Keyboard 0xdc905:$a35: get_ShiftKeyDown 0x112b25:$a35: get_ShiftKeyDown 0xdc916:$a36: get_AltKeyDown 0x112b36:$a36: get_AltKeyDown 0xdb571:$a37: get_Password 0x111791:$a37: get_Password 0xdc060:$a38: get_PasswordHash 0x112280:$a38: get_PasswordHash 0xdd15b:$a39: get_DefaultCredentials
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4314970.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4314970.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4314970.1.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x349cc:$s10: logins 0x6abec:$s10: logins 0x3444c:$s11: credential 0x6a66c:$s11: credential 0x30706:$g1: get_Clipboard 0x66926:$g1: get_Clipboard 0x30714:$g2: get_Keyboard 0x66934:$g2: get_Keyboard 0x30721:$g3: get_Password 0x66941:$g3: get_Password 0x31aa5:$g4: get_CtrlKeyDown 0x67cc5:$g4: get_CtrlKeyDown 0x31ab5:$g5: get_ShiftKeyDown 0x67cd5:$g5: get_ShiftKeyDown 0x31ac6:$g6: get_AltKeyDown 0x67ce6:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.4314970.1.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x31eca:$a13: get_DnsResolver 0x680ea:$a13: get_DnsResolver 0x305f4:$a20: get_LastAccessed 0x66814:$a20: get_LastAccessed 0x328d7:$a27: set_InternalServerPort 0x68af7:$a27: set_InternalServerPort 0x32c20:$a30: set_GuidMasterKey 0x68e40:$a30: set_GuidMasterKey 0x30706:$a33: get_Clipboard 0x66926:$a33: get_Clipboard 0x30714:$a34: get_Keyboard 0x66934:$a34: get_Keyboard 0x31ab5:$a35: get_ShiftKeyDown 0x67cd5:$a35: get_ShiftKeyDown 0x31ac6:$a36: get_AltKeyDown 0x67ce6:$a36: get_AltKeyDown 0x30721:$a37: get_Password 0x66941:$a37: get_Password 0x31210:$a38: get_PasswordHash 0x67430:$a38: get_PasswordHash 0x3230b:$a39: get_DefaultCredentials
0.2.SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe.31ea1d8.0.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x27d2c:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x27d70:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x27db8:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x28044:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutuser $true 0x280a8:$s2: Set-MpPreference -DisableArchiveScanning $true 0x28100:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x28158:$s4: Set-MpPreference -DisableScriptScanning $true 0x281a4:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x281e4:$s6: Set-MpPreference -MAPSReporting 0 0x28230:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x28288:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x282d8:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x28328:$s10: Set-MpPreference -SevereThreatDefaultAction 6
Click to see the 13 entries

Sigma Signatures

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IwUNvHNy" /XML "C:\Users\user\AppData\Local\Temp\tmp2885.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IwUNvHNy" /XML "C:\Users\user\AppData\Local\Temp\tmp2885.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe, ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe, ParentProcessId: 5996, ParentProcessName: SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IwUNvHNy" /XML "C:\Users\user\AppData\Local\Temp\tmp2885.tmp, ProcessId: 4572, ProcessName: schtasks.exe

Snort Signatures

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.6 - Destination IP: 111.118.212.38

Timestamp:	192.168.2.6111.118.212.38497235872030171 11/29/22-19:38:19.561263
SID:	2030171
Source Port:	49723
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.6 - Destination IP: 111.118.212.38

Timestamp:	192.168.2.6111.118.212.38497185872030171 11/29/22-19:37:32.174046
SID:	2030171
Source Port:	49718
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.18868.10449.exe