Extracted

• • Target
    e18a8c681f7f2876a5a4d2f550cc63d4ff25c05ab942d80c4d3a71dce497d4ba.exe
  • Size 909KB
  • SHA256 e18a8c681f7f2876a5a4d2f550cc63d4ff25c05ab942d80c4d3a71dce497d4ba
  • MD5 13a137bd40d2e80631643edb02c1c3ec
  • SHA1 2e83c4ee2a8f68df5dada72f7cc5ae0eb857c023
  • SHA512 af2b8ac3148ac8dd0adb2bbc803495b325d558f62aa5b34961b5eea797ca816efc03a2ff2d740583f47a466afcb9a7edd773703a5064c03b87c827a4550eac51
  • SSDEEP 12288:k2plrlhie0OTnVh3bj3u/afP23Ra03zWW/YzbywiTEChm67gl41axGJUTL8GwwaP:nrlhie0MX3nPfP2B7Dd/YnC01l4QXhKP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2