Extracted

• • Target
    DHL_046s01900330081250b4057885831102020.exe
  • Size 680KB
  • SHA256 f0f1815ffec14ed9df683a6518c090d38b5812aa49f3591c5ddd50acd1963c0f
  • MD5 863efa623927c73d07fb9b38338bde87
  • SHA1 12c5bac531351a6ba415099afb0fd6a785b06c43
  • SHA512 6975684fd15b10f8bbfd317ec2f4f101e33474b3c91cd97cf7467758db663d49fcb54705370a292d762988edce06d9bc6b7521db445524e03919733da7c70c84
  • SSDEEP 12288:PqH2iNStcYhsuXI1q9sRuHWxRi/2SOpyxzyw0OCvaVEw4ANKFavf0NrSXXdVFvqb:PqH1MchuLsZRXS+yMNOEwFKCf0NYXZ+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2