Extracted

• • Target
    d74461873f8d893100c0e403c7c6a226f599ea460ec8728e1710abaec1340753.exe
  • Size 699KB
  • SHA256 d74461873f8d893100c0e403c7c6a226f599ea460ec8728e1710abaec1340753
  • MD5 49eff33842dda3fcb861cfeeb65d7029
  • SHA1 73f0c7558a803a1f5baaaac5291c67032ac3c45d
  • SHA512 105b9af2e5840ec6d23ea6576e3b4a504a57da0d5350e0b73cfc05c6dd8fe6121e62aaaabf17de2fe3e495477f6c56464e147020185e148ad66377a4f09ffbd2
  • SSDEEP 12288:ngZfSdz7hXIQ0K02IaRd9Xbk8JxrwLxLhIcH9hYd6vEgvWEu5fH2XdH:iSdHWd29FxrwxHH9hYwl+z5/kdH
  • TLSH
    T186E4124E6EA5EBBAC92C0B378007780D86E74649F570F7AE6CD99DE50D24A91D80F203
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2