Extracted

• • Target

    553e372ef331a9891f8cada32625bd6491cbd427f1a2a6ad62cd1472ec3f23a0.exe

  • Size

    731KB

  • MD5

    487581e26f44dc342b13f83a424a7d0b

  • SHA1

    f63e3fdfa598322bd2ededb12a2c272182824990

  • SHA256

    553e372ef331a9891f8cada32625bd6491cbd427f1a2a6ad62cd1472ec3f23a0

  • SHA512

    9e903d9be418a8d024b566bf06d28a300bf15f3fa042a4a8ebe7b8e186a8cb50ad19e5a892e5137dccc05fac4b7eabf6236592b6efcea045d68ad1988c03a99a

  • SSDEEP

    12288:UPU2iNPyCK2xrOo2BakSVelkYawUlrc/6t2SLck6en6Oj0KlhKAgLEwkR:L15yC5ESVkRallVGzgfkAX

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2