Extracted

• • Target

    947fdcb65f5b6166fe0d305b23b0511df64a0beac4419c0dea66906a13d613e0

  • Size

    3.4MB

  • MD5

    97e233b02e8d769bcdfcb55f72523def

  • SHA1

    cd24518982e28841f0b6105465504787e55bd625

  • SHA256

    947fdcb65f5b6166fe0d305b23b0511df64a0beac4419c0dea66906a13d613e0

  • SHA512

    5a3e841c60c1126815f68286c6c1ab48cd0364e444aa300ed2701e338ad74d740a0a65851f26df4c0cbba7797a2dc456e2680a59c94dce757aa2ea2af998ebe9

  • SSDEEP

    24576:EgcGT/oh1CzMP5V+XdHfwwR+Dc/+HmIZSN:7cGEkMhwXdacGGIZSN

  Score

  10^/10

  agentteslaevasionexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2