Extracted

• • Target

    STATEMENT OF ACCOUNT.exe

  • Size

    678KB

  • MD5

    a6860f38da5460092e32e7d3ad40d73b

  • SHA1

    35105d4db8c8e4953741b45b66b7dda4557e4513

  • SHA256

    364c37d1a5142ecaaeabce403a7809a109348f94afd4fc547d862ed9b0f83bee

  • SHA512

    c3c12ce308ddbcf215ddab0d1d5b3ff25ae963d0024d93bfd7e807b7a1bbf6b239f206ba007ea9bf512837608fd658a3994bc91d993f3204e25178ada0783116

  • SSDEEP

    12288:av3XNuRchUsEcC8Yps/OACjZndhizPiI7vylo9QJHfekWb2DPR07kR:cEsZY5pdQxvvI/WCDz

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2