Extracted

• • Target

    #$AItslip1546.exe

  • Size

    666KB

  • MD5

    379a6b94c8ebef8ba5772842a3b51fb8

  • SHA1

    f91a970671bd23608e3e32115c3fb34f92301a30

  • SHA256

    2ca58fadf27f88b2a39abfd4dbe4950173a7a113bf91b404734510dbfdf7c557

  • SHA512

    926cc9558a8a88aa3cfe172635e331c0fb630d7e4bcd0f047208d65031f465efbd288e2896dfb322ca03f1cc47be3fccd1e0c88b04858be6aa08e1d6d9e7c64a

  • SSDEEP

    12288:2xgAmi8LkpEalnNI6k2HE64HZNzcnd39eOf/Ero062EXKffuv4pbuXEBJ4fhZP5g:K1VjEEPHEpNzceocv2IuAZu0BGfb5IL

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2