Extracted

• • Target
    2024-11-14_fa4846c0444989818272902a0e5d2044_formbook_hiddentear
  • Size 680KB
  • SHA256 0cdd69862bf252d0ddbcbdf11612604b8cc055c7b09d5b948d84589569c492eb
  • MD5 fa4846c0444989818272902a0e5d2044
  • SHA1 89aae664e482a33ad57ff2d6afff08f9054bcea5
  • SHA512 6f4dad2ca2491dadc1315b13cc1b76c03a855ce50c073481ccfd52c1fd0af2c754826947e3f1e83cae44c8a777352cc97ddff67b98ac1b59e47b02d04e37f74c
  • SSDEEP 12288:qMyCUQXJlDNTPcNLzW6jFhxnd0fA+Qy7nV3A277LRODSZcIVJvnbr4EiGnU/P+Vv:qMyeX/DNTUNLzbVCPQy7ni27pOOZcSjY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectiondiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2