Extracted

• • Target

    NEW SAMPLE ORDER.exe

  • Size

    886KB

  • MD5

    755bd5d68b7534193c16fbde38f20bf1

  • SHA1

    a8e68805e2cca84d6f0c1f4525eb5bcfdd29587c

  • SHA256

    30118db79f45d9e495d85d5188ebc4e010a2bc33258b8b0d0d1abfd1f056502f

  • SHA512

    89c23f3a6e879ba82d69dee9e715ece517abd467f678a28e96eb0ba1c7e3a7fa12e1be611d16956e47672938ac2cc41c078d70a083d57214f43f383f2f9a920e

  • SSDEEP

    12288:MHbCiAEfDOKa9Uis/5EDOj3SqlV7iOE+nf336MPSbZYALL5xuieo8YXHAq4UkR:+CRE7OK2Ux7j3ZtRtfjPSbZR8MXHAqk

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2