Extracted

• • Target
    MCPO2501424.exe
  • Size 728KB
  • SHA256 ef2ef9c4bbc252a65d09f98c7dfe0c89a004bf4df3ccc3dcf65230cfcadf580f
  • MD5 ee965815c95155b742ea36dc868dd6a3
  • SHA1 ce184dd29dca1f40aa907cd9d2b0de32286755a0
  • SHA512 aff8d8db2588b0e13149c85c49525e5cee3a1ab6349d8699baeeddd999e29788c48c907c479ec14fd7af0bf5d5448cbae11f132268fbdae5daab742ef5460a0e
  • SSDEEP 12288:oSp9eRPAuSSJQ67EKO+qtH2EMl3AdfcfLyGuJrZGgqzfAR+Ai1kuBtkWyZVmeBkR:19+VSWQ67xaNPEmkfuGuJFqzfA8+e
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2