Extracted

• • Target
    d5a64294b4a47e260bf84a9819474e15fa6ffe9ee515a5db68967fd2837f9f1d.exe
  • Size 785KB
  • SHA256 d5a64294b4a47e260bf84a9819474e15fa6ffe9ee515a5db68967fd2837f9f1d
  • MD5 34c09836453951d6b12dc61c69c2e23a
  • SHA1 8c75f57b9929fcc4dc3005d092268a0589fcdab9
  • SHA512 9290671794704bac01454571468ff365004521ab4fa14bb32d9f12de868e23987d2ad7ba33ae3c6cddb295a453361209a2c4ec1fc85efaf916e2f32575b37387
  • SSDEEP 24576:avRC3c6GxY0hbtGs1KpG836sqg+aIymzK7PgtY+VTYC:a5NY0hZGs1K+sqgN/EKbgtY+VTY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2