Extracted

• • Target
    dd566ea9737c75cf44885c842a944952d23abc1fb315867b4f07c3b8f37ce01b.exe
  • Size 977KB
  • SHA256 dd566ea9737c75cf44885c842a944952d23abc1fb315867b4f07c3b8f37ce01b
  • MD5 1165b11c05474471dc47ff054f8e4398
  • SHA1 41977ff5db4bac80d999bb8c5d6eceaee6d3b9ea
  • SHA512 3dc9dbb18a581630daa00bc59d7aee668881c5464ab7b32b2bd65d9e80376c4e3d5029cce902c9576c05c58dc8c46b2ddf44e8b8add692b6065287c617a3cc6d
  • SSDEEP 24576:1ggC3c6a+JXEbSEnORzgF4hWV5ukNaEIkq1BYyS+TigtY+VT3rMxV:1/YJXEbS9FkV5ukNaEL2uySuigtY+VTc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2