Extracted

• • Target

    044ce9e194f5194b8d0e12e8e05fc3a3ff3782e60d5b3838351e80ac43663e4d.exe

  • Size

    668KB

  • MD5

    cf021b7974c2665564085795f85a0ede

  • SHA1

    d2084747f540500ab61974ac288ab05f9d91334a

  • SHA256

    044ce9e194f5194b8d0e12e8e05fc3a3ff3782e60d5b3838351e80ac43663e4d

  • SHA512

    cf5d6acecf132c3a01ec82b3f4e8e2c66c854611b6d71b53d2b148fa492c47f800eb443a9e46828fb3cc3b408da571ee86ecc31facb67f8d7bfbd9560b7780aa

  • SSDEEP

    12288:iGCCi8LkpEatgdWrtzQswH4X1nqcSg+jEKAEGaCtXm3dCcQBoTY2ZkR:i9ZjE0GqNA4X1ijEKAER023d2BWE

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2