Extracted

• • Target
    SASPRMAT26090223-SASMRMAT26090243-148S-SP10.exe
  • Size 761KB
  • SHA256 5655ca75072c426fc5e9c88176998ba35464253ac8343e9c8d084d24dbfdabfd
  • MD5 b3c35eaa319f62d8a8519ca26c4b0ea6
  • SHA1 a0d2934785d80f6b00ba46534db75bbf0b4b139d
  • SHA512 c17d8ec1c564f77cd371dc966fd12ceb7a24a26bfea161d68d5ab74b19d666548415ee8b0451b89752813363c36f413758fc74feeea3bf204953c05a54cde705
  • SSDEEP 12288:lZjBkAe4FoxoBQh8GFIJThrgJsXg/gQuW0u5Sq2x1XeRj5VHGFM2q5mkOaqvUS4r:XGi/BQ/FHSUuW0u5kQ9uqMktq8SLV/
  • TLSH
    T1C0F402543A78DF26D47A07B91571E33A03B96D4EA420D31A4FEDACFB3D22B062C54693
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2