Extracted

Extracted

• • Target
    rPAGO_8732.exe
  • Size 836KB
  • SHA256 86f2279dcd0fefd01392dda46e202ae5e1528322b34ddf7029ef3efd58b5b45e
  • MD5 0668ddb7de67098ce3a2196f81602740
  • SHA1 1e54e23d77360b45a297ee1e4040e51a93fb38f8
  • SHA512 04b1d59543f65533efab5fafbdda3a75feb8bae34b3f91912692b9d46773df2b417e1b672b470d6e565ee5e54c298bf77b37721e6be98a8c4583d4ee94afad2f
  • SSDEEP 12288:i+x504bFtx504bFWxPah3iI6p0lJy5hzmnIFMgKOyg+tlxoJjzX374:Hw4bjw4bZ3k0nmCIFMgxrfn7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2