Extracted

• • Target

    aac4ee05a5f1436d0c89ef8a13bb1b39ce4cb3bd5d5be1cb5413581887290cc4.exe

  • Size

    1.0MB

  • MD5

    728a0287e37a2829eb6a1ba56302db14

  • SHA1

    ca7d616c2e358c99e137ac13f79f9f533524ad7e

  • SHA256

    aac4ee05a5f1436d0c89ef8a13bb1b39ce4cb3bd5d5be1cb5413581887290cc4

  • SHA512

    c74b142f98dedb1315203b061ddae9714eb64ac8000ff63a796efc43761ccd56af46fd8a9f7f2f95e06d82da1d5f1a012535c43bf49541f3b3a1f66ebdf37052

  • SSDEEP

    12288:1VLaID7XkuLPjNkKUaYNE/7qklO4EEZZivikgkX2tSQgnz+iDkR:1vcuTZLUHwqk9EEZZiGK2tQbW

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2