Extracted

• • Target

    66b47edc718777de883b1b511adf41616b6843d3a6c32d8e1a257856e9ad449d

  • Size

    654KB

  • MD5

    d9025bb380a45ebcacb4af7e40203836

  • SHA1

    413d0ed056b7d387548ae567ac3fc9e3f6a307b8

  • SHA256

    66b47edc718777de883b1b511adf41616b6843d3a6c32d8e1a257856e9ad449d

  • SHA512

    2be6b524ad84fdca06aefc4ee43d1fc91b2996a52822dca538855fac62a41540bd4d60e3356287bea4f93e6ebf963c3e62e3e176b57e39a046864d9999e40cae

  • SSDEEP

    12288:VdJS4VTpZLx9W0XEuTbsic73tmc2W02RFvkIggANhv0bcVA8Sf:1ScTHGEEuTaF30eFvkIgDvZA8

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2