Extracted

• • Target

    TT_COPY.exe

  • Size

    421KB

  • MD5

    458145b74718d73399391f3cd02e6192

  • SHA1

    058788cc18f08f58e4104e33b9546f91053102f3

  • SHA256

    008d79b95dd17c51b103bf87aabf1e5a3ecff06c2ff26a5b5bce23ac1e0dda9c

  • SHA512

    e44d1fea9445603417ede137eb38462d47b63c035ed9bd81b1c901fa6d98594c54dfb16fee48f7deccad8086b107af7d664e604dc8cce64ee9781aa5d08cae68

  • SSDEEP

    6144:xDxG2DAohI1g3YNFOvgwXnWgAsLiYRgfcpF0EAWMxRRLmKZ3QW1bGJ1:txGMnhIS3YTfycsBRCcLLAjxRl1gWZa

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencerezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2