Extracted

Extracted

• • Target
    0829253_0960206075_KGECICI_36_01012025-30062025.exe
  • Size 685KB
  • SHA256 d6d543741f22a6a4ccc7c66a73ddacbe7918818dd0717f004c3216e180e4da99
  • MD5 60fbe610b13e76b4cd6154e9c0ae92ab
  • SHA1 5a3b715f5c3b69c9a19f8caed1355b1f98474ab7
  • SHA512 2fbf9a3e93b320437045d012e3ad91633b2f7fb1891ed67abc9c46f81a0027d1b1e81a0f2ebf3ca8d0ad75cb0211d427f86077c80bc6bf6498c131d6aaa23c3f
  • SSDEEP 12288:I2oi0i37p+heRCmIQM1/3SFNBkEW5Q/WAzDqhrItX7PADS35M0O0OW:Zo9i8heRYxJSF7tb/FmFIx7PA+35
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2