Extracted

• • Target
    dbecf6e2bad4b37d6d724a33c84bd1826dbd4f6eb0c490ef152b261c67edc751.exe
  • Size 738KB
  • SHA256 dbecf6e2bad4b37d6d724a33c84bd1826dbd4f6eb0c490ef152b261c67edc751
  • MD5 9392967d0194cc91a9ea06df2ae2657e
  • SHA1 13a94dae2f6a743dcca4ad848b08d5cef9c1e8f6
  • SHA512 235bb918bcbeebd0e0714daa7ac5e92c03a67451b0fdf69d2a191473646744949d81fec5135e83fd6a211ccef8f345ce5a892fb3c8f9e7350044b42b3ace12f8
  • SSDEEP 12288:CedYY8p8zD60Zc93ctYKXQ5Fg3GrkWcyCYjfK4xeksThWHncONwvhiqc87mkDBmm:CedYY86o3r1drFcyCYDK4xFsTYwjc8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2