Extracted

Extracted

• • Target
    71ab6ac53c0af815f043a04b31d779964acbe64c4a79cc0309ae8c8840c1a7c9.exe
  • Size 1.1MB
  • SHA256 71ab6ac53c0af815f043a04b31d779964acbe64c4a79cc0309ae8c8840c1a7c9
  • MD5 af63ab0884c3faea791036c5801ff311
  • SHA1 1414d100818f6a08cf7ab4b7d96727aa4caf1ce1
  • SHA512 ed1f504fdce89f3b46bdf453a559e0af9507de2215b06a4def43582fd821364f706c9866245bb56be7ab58cbece4ec290bd911d3bcaa09bda4826f1206f4f2bf
  • SSDEEP 24576:iJieA9sEkO5GOQBV9iZ7lG2BF7S2zg8yVcg73CJULWl:iUsE/QLHw7lG2X7gOGLWl
  • TLSH
    T14B45CFAC3610F59FC857C9768E64ED74AA142CAB9307D20395E71DEFB90DA87CE041E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2