Extracted

• • Target

    work.exe

  • Size

    1.9MB

  • MD5

    696093ad8d776d6a18e21e60bbfcb00f

  • SHA1

    cbf05a6a0abfe1245b7bc3b989a82c40e896c6ba

  • SHA256

    1130ac1350c012b1ef293304ae61c9abe22ac8a0e20c708de009fa037ac71421

  • SHA512

    b30fc0fef3181999e12a522ec688a6909053462c64cddd63705a99d7d4d4488fc95b338ae1fd65f6f50c1c185b1edfb060c014ff5177636bfa098c0165beaf48

  • SSDEEP

    49152:Od+KzYgjTWq2EtZ4KWSHWm9J8CCNI5cJ9WasWtkWGOfWAk4ZnWu5DO8:y+QWpEfZ2m9Ju25ciasWTGO5k4ZlVZ

  Score

  10^/10

  agentteslaxwormexecutionkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • AgentTesla payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2