Extracted

Extracted

• • Target
    e932be50ccbedc897851689fa7fbb5963e839089fa84c321e226612001de1d83.exe
  • Size 702KB
  • SHA256 e932be50ccbedc897851689fa7fbb5963e839089fa84c321e226612001de1d83
  • MD5 45b33152292dad25a904ad60fced8a28
  • SHA1 ac16786d4cbbea2121c952f69f999a507c591a25
  • SHA512 9f11ad7c96052d7a145d09a1de7731e279c41fe9f6e2254ffa0574693fdbdeae0d7209c7c1536351bdc07746157145db9b3856aee21bd7aee60e55908640e737
  • SSDEEP 12288:aSM42iN3skSKSIwLG2SrRCOQRir96PXE1eCZwdGxNaPm7ab5cCaXEAbuFkgjQs18:aSd19JSNIX2ScHRirUXKpwd/vlcJ0yIF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2