Extracted

• • Target
    d3930c8a1f76597757a019c4ff92aa84de54045ae44fac8008c296b767576b9a.exe
  • Size 717KB
  • SHA256 d3930c8a1f76597757a019c4ff92aa84de54045ae44fac8008c296b767576b9a
  • MD5 82513f086e9bcc0ecb58c1424639df4c
  • SHA1 65ba8c91e79a367f514718225efe98eba96b561a
  • SHA512 7895f3a03d9db6a99032fdbf3d5eccab54a1d1f438238b977cbd4b8a8cae0e620cc533d0266e773558f5bed6714df26fd7e6e8fd72d0455cb208735be7c87f24
  • SSDEEP 12288:03qyJMxCx3LRI3VtSWshfeO6elvJoAgq5D5EHBjNh/Cr5n5WEcOkR:06OECxbG3Ls1eOr5FwZCZgpV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  behavioral1behavioral2