Extracted

• • Target

    1736cd52fdc1deacedeac1de86d461ceb01c476e307520762b74b67ca8fa4b4b

  • Size

    669KB

  • MD5

    9f1263691f61af5eb7a7b8ad52134be2

  • SHA1

    2fae8614a8c48b09140ad431d20c89ec0e6c70fa

  • SHA256

    1736cd52fdc1deacedeac1de86d461ceb01c476e307520762b74b67ca8fa4b4b

  • SHA512

    4b5de03719f4fcd7bc2cb94879589b605c8f95cb397bf4293c781ffdcb4e1b42953bea8da2474f73a2d4de162fcc4c11d9b99a15c9acb0ac233820bf9039594b

  • SSDEEP

    12288:1z7kvDoQE2wD/Cv3BZCU30HapCU0q3ly+t/DlVUjaKPTUw79ylQ/ePooitapDcaJ:1zoXwDgZ/096v3UFPDw3goitapDcG

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2