Extracted

• • Target
    8db679fe4d6d844ca5e599d8fe6d8daacf115b319634b21b0ec78525a482819f.exe
  • Size 978KB
  • SHA256 8db679fe4d6d844ca5e599d8fe6d8daacf115b319634b21b0ec78525a482819f
  • MD5 3c480229870ae9c24151d91cb2e6474c
  • SHA1 84291228c13ded1904e5c725db1c69657a06450d
  • SHA512 4dcbefcd197df4ab521640217b8b5de086a8145b80b5adc200e5d132af077c9645367f95881e0f383909e2f734226b9ca5182269df7040c0c6ae35b407f61bef
  • SSDEEP 24576:WRWli4UxqwmAd8ru2niUeqHxfx20Rhf3L0uOoXHXZCL:W6i4DSd8riFkxc0zf3L0uXXZ2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2