Extracted

• • Target

    SecuriteInfo.com.Trojan.Inject5.5513.6456.21079.exe

  • Size

    685KB

  • MD5

    a31c1068dd46375790e713635c76aa35

  • SHA1

    cf8b211261897325d695961e527bb277858115ca

  • SHA256

    3e85a8a29fb89fce3fc4fda0fad1158a7d001d39378b361d6226221483cf7387

  • SHA512

    ce4796363711758a1d1dde62d47f22667e15501bb4cbb8ddf3205f8a37726cef138cc579fb892d669770f234d41742e75f9a746c888e0903c774b075c29437c3

  • SSDEEP

    12288:ynGMLZX6O/HjU5LgyS65bvmhvRuU/r74GaSD4ef884DUtsZzaulM:qp6O/DU2oaRB4GaSxm4tKlM

  Score

  10^/10

  agentteslacredential_accessdiscoveryevasionexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2