Extracted

• • Target
    ORDER060424.exe
  • Size 649KB
  • SHA256 dc2e8a0f43a7ba9dc6ccf14dfda7e6ddd366d137cf774e221b09165ca6b414a8
  • MD5 0c0a41c08e05cc17ec190a8325122ff1
  • SHA1 d626dadb8389d7d3a2ef8a4d55ea1e93012344df
  • SHA512 eedf165ebccb8a4c90664a4eaa8389aa7f67fd03035e3e3592dd8ebbcf0c4f67e2cc398ecf5838469721fffce7b511c74f2973632d065fef825ef15acc0ce5de
  • SSDEEP 12288:Fjgd/iFIsPAb/z/6U66JBBQILFuCJJ5JAl9qv+6Pt71rjzhO0dto9Vy9j+jtIU0Y:9gdkIKybs6J7QI8CJJgXqvdRrPs0dtDg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2