Extracted

• • Target

    T.T Copy.scr

  • Size

    853KB

  • MD5

    f7ff04b1c105625810a3587f2edbc5c7

  • SHA1

    d3e9ee995d4fcb67fa445196db12fa393a69f63b

  • SHA256

    2c383aae867d24468c5d0c143aa2ba0e14658843300b5d5f1f1f00744fd4db85

  • SHA512

    94172952bc79eb4c4e7b98eaf27a5aa153ad4c71a4e6043fb8d7936d8b3c1dea60da237f41a6d282228ba59f1cadd7d66d325c154192867e19608f1cc180ece5

  • SSDEEP

    24576:nVkWtb3BECZIeAxkWmsQcMz0UHrs8WZSTgB1nILabVfp:nVfZBEGIeAkJzmZcP2bVh

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2