Extracted

• • Target

    ui.exe

  • Size

    3.8MB

  • MD5

    3569910289e6b0091cebcd43b30d93e4

  • SHA1

    bfed29dd51e28326e17f938ddb5ff59f84aac622

  • SHA256

    eec8c10e557878b327ee9e50e7b87a8205949a30775d792ea6b24b427ed01bae

  • SHA512

    7e6af73b5fafd6edfca3a76ef00f8b6db0d9ff6be317f1cedb5003893d9fe31041963145ee77953c1ccebe967e3d83b216615d26a0e5ee8c1e3c8826093d9b7e

  • SSDEEP

    98304:ZPnQZWNbNHjSZEGECRLpXa+0BmoatvfnagX/tbBhlD:eWNbNHbGEC9U78onGtjl

  Score

  10^/10

  agentteslaxwormexecutionkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • AgentTesla payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2