Extracted

• • Target
    556ef0a9dc3b216ee75fd880eb3ec7791a763411210442c423653ecd30b2a364
  • Size 716KB
  • SHA256 556ef0a9dc3b216ee75fd880eb3ec7791a763411210442c423653ecd30b2a364
  • MD5 e88b2b7eb8578eba01fc7edbf4667d4a
  • SHA1 cab481032c17a996ebea0c8533e159db6a695dc1
  • SHA512 720da54d07a0276d79097831c26594758ee88e07e03447326812c198b6b09372f4f8091328a00ebde37206f956760d8e86f97f91c8633b97812dc149eb05e254
  • SSDEEP 12288:1X0px9V36Di8BtLrbl8NqGZcXtI7nUdPZfotEBEg/E0RWdzgMs+2+LGTxNuip:cBFKB58NqGZaI7UTfIdgVs5Fs+2qon
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2