Extracted

Extracted

• • Target
    order .exe
  • Size 3.0MB
  • SHA256 f2199b5af4d4dba3bec535acbb4fadde6145ddc841dc13ee4a9aad7d3db63ff1
  • MD5 cf915d0133f110684b2bed7be93200da
  • SHA1 106c7d2ed3bffb26fc614664d4fa6f41ea761a1b
  • SHA512 d0b0b866c8429cd87960da8eae1eaee69842bed7911e7ccc65ebc26b9879a794ac2306e950477cb17df5b4e6491c3a111c5e59fd06d00d44dd3684a4cf9aca21
  • SSDEEP 12288:GUIAvR1A7yLrFfxNES8sGaQK+bd8bdsZfe241QvNBKgKcC:hIAvHA2lvERaQKa8xws1aHKL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaevasionexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2