Extracted

• • Target
    d297dbf441e629127055fdcc349e2b7af5dd54f0bb99a710e0314a52693d0165
  • Size 1.2MB
  • SHA256 d297dbf441e629127055fdcc349e2b7af5dd54f0bb99a710e0314a52693d0165
  • MD5 8d1528cde79ef8ef7a68401473133ef5
  • SHA1 04af19d4010879fcd2842b7ae71c78dc11a9c775
  • SHA512 ee8d7de8a7cd1089379473898b4adc1f968d26220e0a13619f8e4728064b821ae46503a7f2a783f7e890349f6b8943eb9cee2a0a10437d32c4c2d66341eec685
  • SSDEEP 24576:yctk96WWPfawmXcuHDHx4Cb55VskD51iALsZUTOqofIlhChgdgmu:zk96WW6JjHx4C51NQUT7ofIlohsgmu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2