Extracted

Extracted

• • Target
    Sy3CL61n0uDC55M.exe
  • Size 781KB
  • SHA256 f95c4cfa4575ecce08ce137d4fa5ede9fd4356814c770120dfea81d1e3ed157f
  • MD5 d0f3cf5271f7290a5779928f06bc96c8
  • SHA1 981c80a9a2994d639c6c2a365c275519318d771e
  • SHA512 b9c0fd1949caa9b9d17bb9a468e50a98deec78a80e20172dd8b9b78aee8b7dd796e3500f69caea1196e82f95ae30acbcd603ea7e83699c064c676669b8e79f58
  • SSDEEP 12288:XHXNyvK/hPZmR1f2J3C+dTCienDEB22NsuV1F6Oa4wSvnsGRf4ATI1Rsos+Op0kR:X9yGPnC8GF4m+yYvn54sI1a/+O1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2