Extracted

• • Target

    Payment copy-INV 311197.scr

  • Size

    659KB

  • MD5

    cb576d842332c735fd2187e145c61d3c

  • SHA1

    9ffa9ce013caaac448c7fa1caf3d956263271a08

  • SHA256

    940a87f6bcc82595c9bbec3f55c28cf479262344874f8ba1a7a804dd747e3334

  • SHA512

    337ab46565d61f126bf7cd2d940bcf1e234bee72516981be2ec8f0b183532844c323529b7973bb87ad7f345b553e410001e3ee06bdb725ca5c2829c600128c2f

  • SSDEEP

    12288:VlYifT7wT6qz0IWrkmpF3LhE7ukBdaA0e3gQBGzj5BJe3MqqIR8jeqvR97M:wi3sAfrkCF27ukmujBQj5UGINqp9o

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2