Extracted

Extracted

• • Target
    Puchase order___pdf.scr.exe
  • Size 917KB
  • SHA256 bddcfdca7da88bdfed52adaebcb8ecdefe3ba41ae99cf2ab5e917025aa03285e
  • MD5 9ad55f83f1e003a0c7db813247a4742f
  • SHA1 1117e131b16bf4c08f671f18ae3730ec64c219b5
  • SHA512 7031bdcb69739aa55a0661c67e366670cc8c683461284b97507b0a9e155bfa317c7af43d53485964d1f930f5aa76656be4340da8ec5d468e2e7ae82f5e8949b4
  • SSDEEP 6144:yp2KFo3o3v3fpsttGNb5y0qEb3+YS23smD30iVy2CMAuCwmd1mISOsL63clcxw2l:ijFuo3vAOzZSaVy+NusLY4jTLDhnI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2