Extracted

Extracted

• • Target

    f7d4eed71f2bdb8ac845990506c335bb64af5877df1925794b000d4a7cf88b84.exe

  • Size

    629KB

  • MD5

    5b35e1e6cdf0d5277fa8dccd5fc06d26

  • SHA1

    ae1f7a5ece26c423477fbb6048db707df4013cb6

  • SHA256

    f7d4eed71f2bdb8ac845990506c335bb64af5877df1925794b000d4a7cf88b84

  • SHA512

    a55f814eb38f8256529bce371e46bd8801abc90aef844768d28d4c9d544084aa57aa421347ba8cead0f01da08e27daad76fe04a65b6b7ed754256091ccad6a44

  • SSDEEP

    12288:cuC2m4rN+8ExBdBT+EOukJEmrxsZ7oFgfiKZUzXrDOGdtTJ1:ct2BrN+8Ex9xIBFwGgfiOKXP

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2