Extracted

Extracted

• • Target
    7b57e193677da69c6ac93c7d2e2dfdafab85037ab0272c74fc4d22b0014ff893.exe
  • Size 1.0MB
  • SHA256 7b57e193677da69c6ac93c7d2e2dfdafab85037ab0272c74fc4d22b0014ff893
  • MD5 58a5510031e3fa7be13b79460906c39c
  • SHA1 438ca85adc491210b27d9f28b10d0d76436a0687
  • SHA512 b51385905c69f55cfa1ac3f3d58b459a03de298ba88df3706aaa537af2dc980db1158cca71357d0f554a8f0eb2c90b3564a5bd0282817a6579b9e6cd13c1dad1
  • SSDEEP 24576:E6hCuiZIY29onXop5Y104jnnCW9c3SR7akFbSDvTr:xhvifVnXop5Y10Wc3Q7DGHr
  • TLSH
    T1DC35020DBEB6AA51C19C5B77D413610C89E78027F2A2F29B4DDD39F04E64789C84EAD3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2