Extracted

Extracted

• • Target
    Inquiry No PJO-4010574.exe
  • Size 711KB
  • SHA256 d36c75eeda6238e518fffee0f4b12fc0fc2e1d56d478e07b64e71814b0f4e1bb
  • MD5 f859abf495e84ef2987d7026cb8d42e9
  • SHA1 70911eb1571a5e2bee5a3cea82b42b07d44e8e37
  • SHA512 9e62d958857e6b6bd00fb519e5e6cd651e4db7dd53097b332053bb16e099ad5b90e9c5c0c78db1a7e4756357c98eeb7457df68340f87daa90d18ae0bb913c108
  • SSDEEP 12288:CiETpbLskOLpffT02TfGIwGM7NSHK3QAVCw+3IuVJaTSxSl8cedu7QWKwQQpFgPY:ybLskWfrXfGIwGM7iglVm3IuVJNSl8cj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2