Extracted

• • Target

    9ebefcd83437e578e4bb058263229340N

  • Size

    967KB

  • MD5

    9ebefcd83437e578e4bb058263229340

  • SHA1

    e9747db002168462e45bc4ebee86407d7739fa6a

  • SHA256

    e237c49f7a3930001d9163e5a013e6f8c5a11e7780ac300ae90c815ebe06c3b7

  • SHA512

    be56c7d61823ea7569815ff7741bb94d75807e38cd6dcbe8d7a7d22efc19b8a82da4c42fbc02ea23eaf0a839935c82c56909db84b0ce20fd1ce12822892306bb

  • SSDEEP

    12288:QGZKzvmKBKYvI8hFUoI8uUGoMRmfCISUNvXpp0gY9DLvZkRUwgeQ7viMzus0J:1KOAFUoKQWQvXps9/xkRUHeQmYus0J

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2