Extracted

• • Target

    5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe

  • Size

    639KB

  • MD5

    29ef191ed82ea8c11cf1f99695ea0faf

  • SHA1

    e9e71a843dec6db3f47f1d7b5c25044761e378d9

  • SHA256

    5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26

  • SHA512

    51d405194b0be85e75c0af8349e2585cc70ccadff7f2e54cb63cd6ef46b923e59907b0f0ef0318958bea87cf34e8441afe59c625cc781c78f16926186e50c476

  • SSDEEP

    12288:7a7kvHzL2pOM7a1t0B51zwIkIGGvtmRM1SHTl7MKAdfwr2lCACZ5ymmkR:7aoHTsGIkCcRMQHOKGIreg5yQ

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2