Extracted

• • Target
    PO-0032820435.exe
  • Size 644KB
  • SHA256 c77ff2d6f8240e9b4d05e6150c71e2086e74b13e923348bbfa88d7bdb3cabf3a
  • MD5 fd1bd55612cd3d128ce9bd864e21643d
  • SHA1 ee1fcdd6391339b5ffc5ead72a3ab43320f275e0
  • SHA512 ab465a68d99efd98ff12d213aad4ba0dde0eceeacb9887de639ee06c8581e0ee46dfde34fd4c9c68e987216e43bfddf1e6c179c44f729da7dec9cdf1ff8243ed
  • SSDEEP 12288:Sgr1nb+prAWQoLDJRYRLsgGacjiDYt+MqAp+IfjWLXB2:Znb+prAjYdasYcGDWT7fjS
  • TLSH
    T10AE4F128239F9B12C4AB1BF51900D4B153B6BD9E6051F71A4FC67CEB3C36B91094A72B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2