Extracted

• • Target
    51e166ed74183299244a9fc3aad6dbbce0dd8ea4c7784bd5e89a1344d97d7b32
  • Size 731KB
  • SHA256 51e166ed74183299244a9fc3aad6dbbce0dd8ea4c7784bd5e89a1344d97d7b32
  • MD5 63c9ae5b362f1fd00e742690e9ed30dc
  • SHA1 f5abd49003903d5eea76d85b950fdb72d0f900b1
  • SHA512 2fe7cb77fceaee75630a9e79ac3dedab6a9583f5174a982e21543dde9ba40ac9613b4971c488435fc50464f2b41c0cdd3c4494ed1e98fcec1d2e9c76f0365422
  • SSDEEP 12288:/X0pxmV36Di8BtLpkX8xsDvkCBbLCpan15x6clQ7QVQbRQ8rvQPkR:xBFKkuqvkCBbLCpa15AGEdQUvV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2