Extracted

Extracted

• • Target
    973b39d5de9edc4a4ca7bf4b34f59cb36074e6c13158409bde3d5078c9d1b536.exe
  • Size 939KB
  • SHA256 973b39d5de9edc4a4ca7bf4b34f59cb36074e6c13158409bde3d5078c9d1b536
  • MD5 0df93374a352e03039adeac12919f53d
  • SHA1 1eaaf7fe115b760c9ff21edc55f9562ab7f461cf
  • SHA512 4d62c088ed5db0123caaa70f1a5af8b7b1f6d1713a7aa7cad9a15c30c77bf421bbeb9c7a83d083874c36204817853e1a01e5c7c3d7ae1c4089f3840f6e6762de
  • SSDEEP 24576:yt8CIahADUw6nISGzY3jCAwBc/6iinolG7YduHvqO+/KI4:ytXAD9f03jmS63d7hf+/K
  • TLSH
    T1321502013358CEB2F9EA6F7096A1E13113A86D295CE0D34A1DCEBDEB787678149F1643
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojanadwareransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2