Extracted

• • Target

    1bf2a9ea09f8638ac50155e3bdb1bfdddeb5d3496d8f44fe2be0b3c57ae16941.exe

  • Size

    659KB

  • MD5

    9370d5bd00e22025edcd9baa5e4de765

  • SHA1

    26f3ad23b95317710865a5b8f8c09ac4ef605ce8

  • SHA256

    1bf2a9ea09f8638ac50155e3bdb1bfdddeb5d3496d8f44fe2be0b3c57ae16941

  • SHA512

    91779cbfa2e48eb7de04f6fb566de9a2b2bd970a26e335b27b90dcd77b39e98347af7a2e2a15a25638261d5427829ccf4a0c35a33ad485de57d81f9482959a74

  • SSDEEP

    12288:pJrlAypLgIuaLiSbFph4f+AgPAw5aZDIZGl98ZJnajRQ99yZ2vhDyl9QaSQ:xAypduaLRbFIf+3b5aZDIZU8ZJajRQ9P

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2