Extracted

Extracted

• • Target
    PU6789000980.bat.exe
  • Size 890KB
  • SHA256 42bf798312044d50fdcd35dca04eaa7bf628fd71e876fa6fa33b95e593d7526a
  • MD5 ca7ebf7e9b85316f5277dda4403ad90d
  • SHA1 429a6bb1878ec8de3cc5f8820e97bf21394bb070
  • SHA512 7f185791eb5fac4aa3f6e83d773849581309602e9503dfb0d6443949ac3c407222d08bf4af9213e88a063751fa64e8fff4aa4918c133b5225a1437780baeec49
  • SSDEEP 12288:t+UM8Hy0IQkb0CIkOIrpXMpDM0gBEcZ6onzMALqZ8gvEcq3l5Rg++:cUMJ0tCIkOIsDotzMAWb8V5Rg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2