Extracted

• • Target

    c28ec21beda0688372e11e53a55f494fd0278929322019739c0084638716a3ba.exe

  • Size

    597KB

  • MD5

    01fcb8fb62b7bcf6fa81e765d0c3f571

  • SHA1

    2fb9a233ba5c4ec26c275b10300b2e5b57baa435

  • SHA256

    c28ec21beda0688372e11e53a55f494fd0278929322019739c0084638716a3ba

  • SHA512

    059f448f4db5e4ca667bc2a7fec0f45705aa9217bdb0bce701670df75cb29739cea2cdd4f1123cd6ff8d164d8552448b28def00c88ae1ff850f8cca0667230ec

  • SSDEEP

    12288:1oGrkbKNHKTGwvqXsIkkTLlrvK94BPbSGgW:1oGIbIHKT7vCgk3lLu61n

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2