Extracted

• • Target

    new inquiry 756564388.exe

  • Size

    753KB

  • MD5

    e2616e5db25d1d56369b2353e2858a09

  • SHA1

    32673a86272a13051f31d3a1cb7b0f4feb24bf01

  • SHA256

    f8adf6e66d98c552826f03dd2f5762f8b0b20e7fb5d3ed4f3c3f706f4b89bbe0

  • SHA512

    9b55d586ab5dfd87c3c6801cb513f00ef3b0a2165b4dc31db4c5d550bdd34d605970c0eb00366955c066d535d67444ce3bc9caf746008ab9fae1882170bbac9b

  • SSDEEP

    12288:BdXtfET1T8+mb9NDp8Q8WLc2a1WaZhBERKOeDJa2kR:Bd921T8nb7D+YcN1zbqcO3t

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2