Extracted

• • Target

    7829bee1b8d38967430412fadabb9e3a16a88fc72b69aa8582a36af62b9a6c9e

  • Size

    718KB

  • MD5

    3a35a7c5f754ae80d5804d1b01a4caff

  • SHA1

    8cf23732723dee574297506c9aa8975b1740a63f

  • SHA256

    7829bee1b8d38967430412fadabb9e3a16a88fc72b69aa8582a36af62b9a6c9e

  • SHA512

    e14c6e108a085da17779f96b16b4874a793aef6c1b398c4387b9916857d4c35cc5c1f5f560fb9f448c463d4c5cb49210723508a69283784965a075b7fda06f84

  • SSDEEP

    12288:ylq0pei36RSr+VDK6avdu9nry4tYs+Qdg1CbgisuNjRIeAKPf5H3URxpGikR:ylNpp368riFgdMy4t1vg1CEikaPBHERo

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2