Extracted

• • Target
    66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe
  • Size 928KB
  • SHA256 66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696
  • MD5 d0497f3106425ac56562fdb456972cef
  • SHA1 4438fbc600c8d013d25a8b45b757329334dfee3a
  • SHA512 235c87ba24128277c1478de1df8d6bfda78622ed8721ae91dde2a619a1d4247b9ce09c0eba30a3a5b003b89208bedafce1f7c6c184b703ac88a0c9693628b234
  • SSDEEP 24576:515yC5XYU5DN41CJkKJmI99Qz9rkGLIY7Y1q:573JPk1CVJh99QzxkQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2