Extracted

• • Target

    CARPETA_.EXE.exe

  • Size

    834KB

  • MD5

    97d2766b203cad5490aeae4049823b5c

  • SHA1

    a2559089ca598289ad964bb3aa63456c0ab8b4fd

  • SHA256

    31f9e178c2015a364ea2035c77eb27f1b40165648900f824945d548e93885716

  • SHA512

    0733d5e248d71e1c385c7c08b83474a90112c0326d3dcadb8d7b68d3c0eaa33c294012e4462fc37a875f3cd64ae727ba558fd3ebed132784525b8802eed1b65c

  • SSDEEP

    12288:Ly2OoPnK3jbgtwPi5CdZV7e8M4iULTXHYHmBE6mHtP38M:Qa/

  Score

  10^/10

  agentteslaneshtacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Modifies system executable filetype association

    persistence

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2