Extracted

• • Target

    c327a59903b4a5520e877c55df33887a0cc3dacf7e96d0d0f16cf39bc207f4e6

  • Size

    1.4MB

  • MD5

    13d44497066ddcb1cde2b80558724640

  • SHA1

    a06e7faad3593be038b1bf48e7155b3d4b036a15

  • SHA256

    c327a59903b4a5520e877c55df33887a0cc3dacf7e96d0d0f16cf39bc207f4e6

  • SHA512

    dac34961634c8c77675505e371c12b19772811ebaccde36f06755105981d7d381a66888dfcef8fec88a01a7c00f8703514480e8cd48de9501da4f736aefb1c47

  • SSDEEP

    24576:MjdajUSLqmovDG2UKxpTaYv1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:ZQSLNoL7UKxpTaEjLoyEkmZ9Y14

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2