Extracted

• • Target
    49e41024c0cb28912f07cdc168899c9e4bf37070b90efa0e5532ce17a034f3b8.exe
  • Size 1.0MB
  • SHA256 49e41024c0cb28912f07cdc168899c9e4bf37070b90efa0e5532ce17a034f3b8
  • MD5 fdfce5834d4380ecfd2f993a6d8dfd4b
  • SHA1 200a7d657e2aa59f235b1c38249b9b7b58e0add5
  • SHA512 a51742c0c0abe5595dd9c4e9677291cffa97c5d697f733e8de1f0ef8f919aedd97020544e193162fd2d479396d08b6a2fbb95f507815fae785205d7525616feb
  • SSDEEP 24576:U1YwJWdLk3HvPKtbEJbdWKXjTbxig8QydIMUJlXTp8r+:1wJkAfPgAvWMjTbUJQWIMAlTpu+
  • TLSH
    T1C13501546A2AD207D9952B742A71F1B8037D7EEDB412C21A4EE96DEFBD32F500C18393
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2