Extracted

• • Target

    PlastonNewPO067476.exe

  • Size

    994KB

  • MD5

    d30bb9df615a8d1661f843d426ff40eb

  • SHA1

    4344e695b5f65917dc68f241ecde4b99cf25d930

  • SHA256

    b54ee7375e7ea979d16b76f183aaaccfa49681e2bd748ffca202fde9cf823346

  • SHA512

    44963c4b52eebb7c07d8cd9b2766faccc045dea166c76a479cdccbba06a9dc1a5b4be1003daed93b72f64f848497c3ae57be99501aa11d4569b30b7e7e26706c

  • SSDEEP

    24576:OeTLGMbsHwgKQuF/WaW+Bsfvuo+YZSU11q:ONHQqDt+BcGodZSf

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2