Extracted

Extracted

• • Target
    2026-08-18_f4d1eb5df87d3c4367610ea748e3328f_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader_wapomi
  • Size 1.1MB
  • SHA256 20429c55a73afdab0975bb4aeac8d61bec3431479a91587850745adc350979d2
  • MD5 f4d1eb5df87d3c4367610ea748e3328f
  • SHA1 cca9813afa027669b352d9efa864cb3689580383
  • SHA512 9c36c6aa7f6f18df97ecf0acc2708d96268c54437c8d5411e5a429e5977a4e328f9a0b4c1a4ee7fa8818337d8af5162b06d7d3972207328f06247f094736a91f
  • SSDEEP 24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8aFoauhP3:FTvC/MTQYxsWR7aFVuhP
  • TLSH
    T13D459E3273818322FE9B9D32CB5EF61D467C6D260123A51FD39C2B79B9F0161463E662
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  aspackv2backdoorcollectiondiscoveryexecutionagentteslabdaejeckeyloggerspywarestealertrojan

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects executables packed with ASPack

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2