Extracted

Extracted

• • Target

    scan_865784.scr

  • Size

    762KB

  • MD5

    ab81060e67501bc08bd8a3f9bac5367f

  • SHA1

    f877625633f98d1f42c50e37006f808aa61630ba

  • SHA256

    7ef4c75ee4a5f3b7f2ac44323d9ba15bcd24f5d0b9e3e04dc330dc6cde421b7c

  • SHA512

    61782aa2dc9663cdeb016a0b0dac91cbb4eaee8f293a1f96486539dae32c144643b299c87745657ad0682208aa5586e1ad3340e62f99f371dbdc683eb3b2717a

  • SSDEEP

    12288:VUxAdWvsd2eUUHd8GX5b+EE203zQeDZDr0ZeVN1csr8qHv0U3TB39:VUxpa2ZUHd8GXhE20DnFf0MVNrnPx39

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2