Extracted

• • Target
    SecuriteInfo.com.Win32.CrypterX-gen.19037.19274.exe
  • Size 689KB
  • SHA256 65b79e68d650ab1f2d6fc5d048b27bc44d54e5cb8f310932b3e18d034ecd234a
  • MD5 19dc9601708e3c9c7a1ab6e46e40910b
  • SHA1 806f06820eae616c4ec95fe316dbd4c24ec6f3a2
  • SHA512 e66c1075f27ad1d06c563723dceca9ee955bb38173e33f6d7a57e0729fbc6e7d6b29928e0ec900a7703be2eb273bfdc7387c7b9df26d70fbf9b3c8d902d42a0b
  • SSDEEP 12288:J9sInh5eLAfybmUFelqEZIZ21ZlJPH2qu/IM0JQ7sRgdIieNG9dCuhMzpGKB0oyO:tnh55qbmUswEZY21Zjv5oIM0KQRgd1Ov
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2