Extracted

• • Target
    cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08.exe
  • Size 662KB
  • SHA256 cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08
  • MD5 d1d5c3e8fdf8df59741c797c0c983a0a
  • SHA1 2bf0ddedb2e3b7f6dca08d3b9d73ffc93c8e8ffd
  • SHA512 ae76dc493e3a65ef3425d1089cd3533b282a64eaf2d0b9da83a1937d53de6f8fcbe1a06700cbe99b440613da458d841d7b2bff2b362df9a6e3429ccd54cb86fa
  • SSDEEP 12288:j6iTjmcO3QFVDpW34bvAdzoG+ZEqMeXrJWGs9XI0JweQusQ2E5r:2kjmcYCVDpW3gvazv+ZAtI0xQTQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectiondiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2