Extracted

• • Target
    SecuriteInfo.com.Trojan.MulDropNET.68.28054.3825.exe
  • Size 819KB
  • SHA256 a4cc43c1a6f7f1a92a70e1a9b0ee4157682ca2e22a9c038400c90f4e0053d298
  • MD5 b8fe14464c4016717c1e0e7c52cbfa06
  • SHA1 1765e18c84d17ef0d6dccdbbab789bb306be2e73
  • SHA512 11c56d6b41f625fd0c08b8a3f87743f42961e2801f100d1732047943f67e0f5064cfd1f872de8e94d34152913ced7ef3a4317a582e0a23f90cec9caa7a266e69
  • SSDEEP 12288:MDzT370ixqHKEXRs2KoL8OeczJDYjVKJSXMSXOG/RC3B9D9ecC042:pixR8s2KRZV1LXOGAnR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2