Extracted

• • Target

    081e9e8209e9f5c66e4f3ae4c80708853ec03c2b5f692e42e0dfeb1f57179d0a

  • Size

    756KB

  • MD5

    2342be8ca961dfed8c829d368262d393

  • SHA1

    0bdf5485a67ad7b4044a0bd2ca0a03c0a6f77ff5

  • SHA256

    081e9e8209e9f5c66e4f3ae4c80708853ec03c2b5f692e42e0dfeb1f57179d0a

  • SHA512

    a522b561415753142415140b9229c06001d22283698a293a9707e8f32e81e2f029122fd91a0e99eccd1be05bad2df0b2aacb0d4eba08d0c660499218bffb2bd2

  • SSDEEP

    12288:BIjWET/mr9K+22BEEzFatngBv48yiQStW++X6y1yCC9m9b6PCzaT/5WcXFAsYGNn:EWtb3BEEv48yiHtT+qyMCgmEfT/5WcX9

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2