Extracted

• • Target

    48dc7a59d9890db7b030f03aba1bb5c64b401e572d4531c7956c8265e846e6fb.exe

  • Size

    668KB

  • MD5

    2b053de6103f3da71504080dc0eecc4a

  • SHA1

    ab90d51c523a61e46ad053c046c3d4765f3b12a3

  • SHA256

    48dc7a59d9890db7b030f03aba1bb5c64b401e572d4531c7956c8265e846e6fb

  • SHA512

    1233e632a9d84f19de8ba234ee5d68e0cee4b3de578bde3bc736e96fb99ef99dcaee9a778d9c1b99ada2f2781652bc8021e8ea47eb20d8da48f0ce328d499413

  • SSDEEP

    12288:RlJMiAEfDX3mKXW1uLzqEmxlU5o5KeNJGlsJWrE8zX1hCWOSBH8ycETckfjXFB:RlaRE7XWKXW7EN5ycuWrrzlMWRBc5kfb

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2