Extracted

Extracted

• • Target

    a7dcb118b6b9eb8d97d916da19153ec0ddcb3deb3f522c0fc36711b344704faa

  • Size

    722KB

  • MD5

    6edf0e40d2e0ec47ead7af030281f647

  • SHA1

    019afb559774d51a10e7e3d5eb3a9d4e05efd412

  • SHA256

    a7dcb118b6b9eb8d97d916da19153ec0ddcb3deb3f522c0fc36711b344704faa

  • SHA512

    66037740cdfa10bcd1ed7690455ba9a220594614772c7994e5217b2c2fe9e7370bff9f4c78775ae080b42e4680ac6e7e14806d078bf9c861ecce7bfcf99213b6

  • SSDEEP

    12288:auWFuxE6b5UCZN8NtkZHexL3zqhEgk+e2QA1A9:aBFuxEfCZIqZ+/1G

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2