Extracted

Extracted

• • Target
    41fd49ca52f66d1ed07fe95fc4ffd2555b085c3d5490f9baee74887af9438d99.exe
  • Size 1016KB
  • SHA256 41fd49ca52f66d1ed07fe95fc4ffd2555b085c3d5490f9baee74887af9438d99
  • MD5 11cdfb338b4a7a15703b831c7a6b550e
  • SHA1 5814b883dbf388bc8d8404c315d2ca2f727b99be
  • SHA512 2ec83e30d0975234bab8e877ba8b7c5405280b213ef1ed08e8c8fd1ed71ca8f5262d58440de84fec13ece264b22fa5d4291789baf56100b06f12de47898920b7
  • SSDEEP 24576:8zqRopCx7eou4o+5j9vpuBFGW1JhPEIl/R9:Ch87eoudy7jEJh8Il/R
  • TLSH
    T18425127EFA96BAA1C99D5B3ED4030A4D82F0C813E571F19A05C438F10C5BBD59A4FA93
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2