Extracted

• • Target
    SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.6404.9577.exe
  • Size 679KB
  • SHA256 6659e8c041d7b2bf5ca0756ea730d0f8cfb7a81da170c1e4c4210df200b0dee2
  • MD5 33ab9ba3a5c0d28ad67f7a69c2434062
  • SHA1 896e3bdb4be33673b8cd48cda807cc37e4923c8c
  • SHA512 848d6497af61d75d1f4bf61653024c38df6a2a4cdff3255928443af196b81659117b60e40151b26a55855333e6cbed872f6becedd0debb0672b9dd231c8e8cba
  • SSDEEP 12288:JBbY22Dj46mMl8QDskeC/yG1AxpmAqQAugoLkVgj8eLXtP/jF:JVY264nQhe1G1kmAqQZgoLkGj8YF/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2