Extracted

Extracted

Extracted

• • Target
    49494f29c02ad372f888b3669595fb189e248b29fcc1d35a3e2be2e57d787fbd.bin
  • Size 671KB
  • SHA256 49494f29c02ad372f888b3669595fb189e248b29fcc1d35a3e2be2e57d787fbd
  • MD5 d650d8f8c57390f4c39ad0cab2751dc2
  • SHA1 b6e169ff6d28e58a6ee7bcdb037ce95df33a37b5
  • SHA512 22767957cad816364eaedd5257eb23a1be66f5a39f5760a3473ed146e93c8b8442592fcf7dd5c2b224a12af4bb0366ab8ce0eeb0033393098c1e2884ffc314b0
  • SSDEEP 12288:1NGxdTDN6jbE7bywYxiLkNQeOVW+nRXmghyFkxAzuN3Xo41GvDKWBh:mVNZfLki0Q2g0I
  • TLSH
    T17EE47CAC3240B59FC917C9728AA4ED74A6602CBA530BC20395D71DAFB90DA97DF141F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcollectiondiscoveryevasionexecutionagentteslaasyncratkeyloggerratspywarestealersuricatatrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

    Network activity triggered a Suricata alert

    suricataasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2