Extracted

• • Target

    31c8d65a3c8791b905bd1a02354e7833056416ffb359e09697f4ea2afdae34e8

  • Size

    3.1MB

  • MD5

    cf99975aa62e40043423eb454ecb4993

  • SHA1

    7060f8467e691d5d1726ea81487eff0613981ace

  • SHA256

    31c8d65a3c8791b905bd1a02354e7833056416ffb359e09697f4ea2afdae34e8

  • SHA512

    3bb7e2e781f0dd2778fd34c66cb8fc860f07305bb762a69d29179e8d3c1577a3976a32439930a5b1a9fc477dc909c300c54545602bc34255cc04bb52a8ebae42

  • SSDEEP

    49152:mzBfc7D7KirEHi0OllMMK8fepVD5eNoisJoZN8AN4FHGaHWNeL:mzuTzYk+UecOhpZ20L

  Score

  10^/10

  agentteslaevasionexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2