Extracted

• • Target

    d9ef9a60e2ff8b148eb5787fc6c9e5d537347211f058ec2b55d8a73bd5b56135

  • Size

    831KB

  • MD5

    0cbeff867104cb61d17bd18f9ad20016

  • SHA1

    9492fd065dd1e201c45bf9f1b4661a9cf9a23dff

  • SHA256

    d9ef9a60e2ff8b148eb5787fc6c9e5d537347211f058ec2b55d8a73bd5b56135

  • SHA512

    3cdaeabfc092d0260a69d479c3ad2644935dd83425bc99fbf4c400f654f13342bf497204bc450aa21e8118d8f00b8102e0d455d4fa791ff81b20948a73c97602

  • SSDEEP

    12288:WYagWET/mr9KW1Lsz7h4JEwanHoe7LjcLl2g48lFmaaG3BLI9oQdxGUhHipTzZmc:DWt5LY+iHoCLY2gDFmM3BEe

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2