Extracted

Extracted

• • Target

    3551b37a5dfbb6f4b3a9fcbe1c8548bebc022d3c92ef2237feefe3e4f6e063b9

  • Size

    812KB

  • MD5

    f5265d837a61cab0e79a767877196b31

  • SHA1

    fc6adb91ed37c2f37c9d84f02af1cc64dfb9228e

  • SHA256

    3551b37a5dfbb6f4b3a9fcbe1c8548bebc022d3c92ef2237feefe3e4f6e063b9

  • SHA512

    1f7a588c9e414f794808a834d4978e1a2354112f3f1977c49fdc5a2a7d0b86ec2dfa620aef7f55d9f3749de46c2dd3516db63dd9889af306c4af463f220c25cc

  • SSDEEP

    12288:XCc0FxBN2iN/jTWT26oD6NK8v0Y5B4QM2MMnM8ey24u1rOPZzkd/14GB:XCc0FxBN1F3WS6muKWBI+pedTN

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2