Extracted

• • Target
    d966d9141e6f7648149e38012fc8bcdb9734247521b82922bb354243805dcf39.exe
  • Size 677KB
  • SHA256 d966d9141e6f7648149e38012fc8bcdb9734247521b82922bb354243805dcf39
  • MD5 570e9b4a9ab96322ea6062acd5f68a90
  • SHA1 713f9ec3d66a473234eecb9895ec6dfc103e165c
  • SHA512 21130539ea010e55bbc3f31b33e8582a776f187172dbf39abb60f5c7076d00004eb34a41d95dca68e8d548b766158c70734ed9a0407badd3e67b69ea5295e37d
  • SSDEEP 12288:9DR+RDgHCN1ZB4PNRECO8+dInETxDG5CmtwPqv3q5+mFl5FQZA:nIDgq1ZB40pdIKOWPqSu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2