Extracted

• • Target

    Product Requirement Specification.exe

  • Size

    717KB

  • MD5

    429730ecefe80ea9b11f3265c138d07a

  • SHA1

    bda184f72851ae98c67847a94e58abb80ae18d38

  • SHA256

    e0a879d49cabbd517cd611b81cd5935e4f024532aa43aeba310650ce2411850c

  • SHA512

    5120a18e2ada665695870f12a79540958103cbf7ee5f3f137c7a2242a9b7843294c5a390caf5a1ce8ec98899d8fccb09b1372d85281682ecfcca0256371f9df0

  • SSDEEP

    12288:7qMVGPNlfw5660NXE6vEylfnrZ8G+yoLd67a28KSo4wei44yql8DOJUM:7WP48X/vEylfn18aoLd6fSozLWHOWM

  Score

  10^/10

  agentteslaevasionexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2