Extracted

• • Target
    new shippment.exe
  • Size 1.0MB
  • SHA256 22a01767b082d5ef80c5f191c653f73fc7d4f9d2742229580fd928a9a867a4df
  • MD5 e3ed377ab14e39f0c07d9b201622e861
  • SHA1 3817dd0939b643af8744806f97f62284aeb54b83
  • SHA512 c78d0acd7585eccb9618666545ecd206ed4b3d0d9cdd8074be607f340a51f3440e7a67e2149c9512cf0a125f74e80abecda5c6190bd865bcc48a7e38df01971a
  • SSDEEP 24576:UcKCuqwmkOTUIdbvjwhcgnc+TCC1tWY5OUrf5+x6nnjqKoe:QqweUwEf/O8WY5NL5+UjqKoe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2