Extracted

• • Target

    d2400e63fabdfd9313b68454cf3e9280N.exe

  • Size

    940KB

  • MD5

    d2400e63fabdfd9313b68454cf3e9280

  • SHA1

    c68c43a945f1abb3db99991775ed77278a5dccfa

  • SHA256

    1a88c364ba0af27175976461ea412e544198d95fd3364900111b17d29cc7c92a

  • SHA512

    e558f77a2c2a824ff1562561db0e7ec389769353fa870867b1d68ffd7d00e328441c6d9dd8bcaf900f539369edef77a33beb6bdfe2f7cf0cb13aedfcf88bbfae

  • SSDEEP

    12288:t0YhtVVtE527pIhUTFGsO9931+oPe+N/jhZbOBskDLfH/EeFGP7r9r/+pppppppn:frtEAVIqOCom4jzKDLP8eFG1q

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2