Extracted

• • Target
    MR-2026-135.MSI.msi
  • Size 564KB
  • SHA256 c571da34ec2edce2816ff4092ab21abc6250a6c410ee1f54586f2170a2d5010f
  • MD5 1e92dfdabae073364ad634f7b5f3d365
  • SHA1 96b89670e9ed749327fb4b3ff114d320ec86180b
  • SHA512 ccbade66dd2d241613c3bac9f264fe660b9536adb5e86863f407353aab175f5245d223dc2fd9424c728bc9b65919bdd52709b791da18154faf387c13ce82a845
  • SSDEEP 6144:mFG6Ug4yDf0/Bu08rKS932ZH1olrr0D+0xKZdQkOgwPTXy95GqJGwebcANDVtdnS:mQUHf+DmpodUwPTXs5GlL6VUTxjWD7
  • TLSH
    T138C42313B3629827D8534736CF9F4AF80E37AC660757DA161A05BB9C7EB315103268F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2