Extracted

• • Target
    1bf2a9ea09f8638ac50155e3bdb1bfdddeb5d3496d8f44fe2be0b3c57ae16941.exe
  • Size 659KB
  • SHA256 1bf2a9ea09f8638ac50155e3bdb1bfdddeb5d3496d8f44fe2be0b3c57ae16941
  • MD5 9370d5bd00e22025edcd9baa5e4de765
  • SHA1 26f3ad23b95317710865a5b8f8c09ac4ef605ce8
  • SHA512 91779cbfa2e48eb7de04f6fb566de9a2b2bd970a26e335b27b90dcd77b39e98347af7a2e2a15a25638261d5427829ccf4a0c35a33ad485de57d81f9482959a74
  • SSDEEP 12288:pJrlAypLgIuaLiSbFph4f+AgPAw5aZDIZGl98ZJnajRQ99yZ2vhDyl9QaSQ:xAypduaLRbFIf+3b5aZDIZU8ZJajRQ9P
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2