Extracted

• • Target

    a10341c58574b8a08c3f1469fadf00b14d93376e3cfe50d0799bac052462d170

  • Size

    750KB

  • MD5

    28a4d4adbc0134107703cd1b2d800052

  • SHA1

    62c5a02ca9fc8ce570992f37a433ef5eb811eb98

  • SHA256

    a10341c58574b8a08c3f1469fadf00b14d93376e3cfe50d0799bac052462d170

  • SHA512

    0b672ba0cea136c277e65eee0b114dd9d4fdb4691d6194dec3c423e16bb3c687d0fd0890c99d8626b8d87a8eacaff9de0d2cfad316b89e43bdce2df84e5af548

  • SSDEEP

    12288:WHtZIA61Eix1//lmek//1ECz0mcMtOzGQRv2XMZACR5leZlN:WHEp1Eix9wbSeo6QRPZA+er

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2