Extracted

Extracted

• • Target

    8690a2fcc08add814e9794abe34747ab00b6f20203463a907f62bc0082cf1f9b

  • Size

    758KB

  • MD5

    3c56beb83725ec9cc4cc58ac98f902db

  • SHA1

    bc4792fd310264597211abb778636a3714159990

  • SHA256

    8690a2fcc08add814e9794abe34747ab00b6f20203463a907f62bc0082cf1f9b

  • SHA512

    399f568e8c638f998999a23fbe137c94cede8f6c64e7dc5b8b702b78a9af5b39d2104d5d3fd8f415ee8e779e0121cb2530945c597b4d7646f16a3d3a03c5ee89

  • SSDEEP

    12288:bIlWET/mr9K+22BEEzFatnZ+9EmVv+Tk1j9hfLLuXzid5tleosqVqBJf7eH8veuD:AWtb3BEL+9pkOTLgotHsqVqN7ecnPBrz

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2