Extracted

Extracted

• • Target
    Outward Remittance_Payment Receipt.exe
  • Size 611KB
  • SHA256 fdf11dc1585e1062c299ee652e789da5091b836f2fc999c99f0e6833e9d0db6b
  • MD5 2abf1feccbed2d68bccdbb29746146e3
  • SHA1 80f841498f9cac7cee72dfab3a360142b326ee6a
  • SHA512 5521b73c2bc506c39870884edd05dcc13caee166e28711411123c342b18fa37a4c8e73ea828df44b2796968c16f42e59101ecfaa9de267bf9585c92fa8f210e8
  • SSDEEP 12288:hxNZl1O97whWtLut3fbAtCylocPpGD11v98qskaiy7dal7GMB:LHlkBkUtCLcBGDqpGy7oGMB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2