Extracted

• • Target

    66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe

  • Size

    928KB

  • MD5

    d0497f3106425ac56562fdb456972cef

  • SHA1

    4438fbc600c8d013d25a8b45b757329334dfee3a

  • SHA256

    66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696

  • SHA512

    235c87ba24128277c1478de1df8d6bfda78622ed8721ae91dde2a619a1d4247b9ce09c0eba30a3a5b003b89208bedafce1f7c6c184b703ac88a0c9693628b234

  • SSDEEP

    24576:515yC5XYU5DN41CJkKJmI99Qz9rkGLIY7Y1q:573JPk1CVJh99QzxkQ

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2