Extracted

• • Target

    23a0eed35d69811a38633d41868a1fd6a20faf3912bde628eb556124fd6e5447.exe

  • Size

    906KB

  • MD5

    3b1b99f3617bbe21d2bd1601e6ce73ee

  • SHA1

    0ba6e0fe3c8f5a0511694421d841c377c1a4dae5

  • SHA256

    23a0eed35d69811a38633d41868a1fd6a20faf3912bde628eb556124fd6e5447

  • SHA512

    6eecd51eea9933faa504959f456707c0c132dbd2598b64830a94232a3a733550efadd03ff5f52c89c658bc016aee3328d429b2382d0b63559e49535cb4fde14b

  • SSDEEP

    12288:cIR4R52J+XtwK0LgcOE7V8oL+SuEQD+Dr/POop6hvbJ30zWA0ylgrdm4Vz0Rppp5:cIeetgclptRK+v/tYlb5FA0y

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2