Extracted

• • Target
    revised AWB..exe
  • Size 865KB
  • SHA256 34911d76f015b110d14bd38bd308454fae7e8b550bc11aca2daab01182e1d8ea
  • MD5 5ad5159d18019228d900ca987886eaf5
  • SHA1 4bf2c4930ca9711b41d3a8ee16994a00572b427d
  • SHA512 6a2f594333e5f896a04a571fe8a487b8d0bc9fd06ee094d6e2fdfd05f236a68f48fd8a80c5c872b94016c451d3c7f11400e5f85df68e09f8af7d79f4e849d0ba
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2