Extracted

• • Target

    8b3c86cb96e0bc77cd80fd68892694cd7f3d899462b2398588c9aa4dc9828ae8.exe

  • Size

    811KB

  • MD5

    618d7fddd76b843f83d6d4c31839b5e7

  • SHA1

    ef36abd8aab3d7fb3f6e7952eded55f8e250f9bd

  • SHA256

    8b3c86cb96e0bc77cd80fd68892694cd7f3d899462b2398588c9aa4dc9828ae8

  • SHA512

    ee7b04ca41683d5625439456f0c1945d12f2fe566d6a29e8969b901d8c7a490cbf14c6525470771941832db3b3b57c22a9966eaf2b24988106252620532d95b4

  • SSDEEP

    24576:zjj0ywkp58986ZL7WwXjygOj9gLEwaGihzyI5:nwywb986ZnWwGHePaGazB

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2