Extracted

• • Target

    a73bde5818cf35b57af18ef482d69a39cf93ab332eb5a1301042c9b69e74dcc9.exe

  • Size

    661KB

  • MD5

    204083e5ee75f801a3aad0078f433cd8

  • SHA1

    386e1a6daa01c95815eb3bd46304cac26dc66f2b

  • SHA256

    a73bde5818cf35b57af18ef482d69a39cf93ab332eb5a1301042c9b69e74dcc9

  • SHA512

    40e278a8bb6cf2253029d46ed1aa01355ae67f2f9b55af704631b4e8ab0520296ce0f53cda772ac5b67c183374115e83700362deef07bce8a2d3b7358546d878

  • SSDEEP

    12288:AQtYJL/6H3BGyBRlgouuplkMUgI1OAPQZ4GcDbMpY2MxhY:VYdCRTBRlgouBs4PQZecMHY

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2