Extracted

Extracted

• • Target

    b2cdec46c2e417f2bf134f797c49dfc403e09f9d2ad82122b1159b50d7dc0ea4.exe

  • Size

    614KB

  • MD5

    9b133488fc47fe6cf70ad27f2d3b83e9

  • SHA1

    21bd4e51d8b49cb282d900066cf97843beddb119

  • SHA256

    b2cdec46c2e417f2bf134f797c49dfc403e09f9d2ad82122b1159b50d7dc0ea4

  • SHA512

    7d1f1c98af3707aff7184946540a5d45b1be559826643d5c1a1fb0728f10562ef8080190bcb712b201c567cfa971838f0774dc18f9d5e185e8662a05a9d95c7a

  • SSDEEP

    12288:VDCV5mhMWx2gZg1yRBsSKdaV4Dv6ZHJMYa0klS0LLtMqEaPOnJik1Ifa029x:Gj11ygSPav6ZKYa0WSoLiwSFI0

  Score

  10^/10

  agentteslaevasionexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2