Extracted

• • Target
    AWB 3609 961.pdf.scr.exe
  • Size 752KB
  • SHA256 3a2922837d9ef526c8e44c93e84decbf93f9c0ba34a43241c1f77f9594f26dec
  • MD5 022ed832341d010cf6216a85435821bd
  • SHA1 ffd43573e8f4086b5ef62d546df0eda2c3a6355b
  • SHA512 2d152831b698e7fd9f03b66e04777d333221d690638e1a7902d7c98b83ebc286a5cd2cb958d1f42fbac123f835f52fcfe0195474ac908cef65a08b4dc24d0c9d
  • SSDEEP 12288:Lu06JNf+w4u6RIn3lA5ot1nCjH4mzdIDbqyf3E9BvCYmnEjqejx7qBkI196:aJO63lpt5yH5z2XqIU978Ejtj9qmI1o
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2