Extracted

• • Target

    51ea5e25e9929f936177805583b205ff39f2575c8da2939c4ef3419672f5e321

  • Size

    830KB

  • MD5

    9015c83e6c78343a9fcc472cb2e3a0da

  • SHA1

    38bbdf41126ac83cdb3fff54923c92822ecf0e8f

  • SHA256

    51ea5e25e9929f936177805583b205ff39f2575c8da2939c4ef3419672f5e321

  • SHA512

    a654d4ce048f5d5ff0f7f03c1ebe52b2cf803155793e1fa7374aa2052c3f1a14d7e58c7cad355d2cb721de7383a2952da5db7b48c20c022272c2769efc2d12ac

  • SSDEEP

    12288:BeKKw1g4oJamVq92lWcrBaalHFsS/55Rp138r98C1MPku+l0CPPe:0pw1g4oRq4lWcdaaYUyrEPd+pe

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2