Extracted

Extracted

• • Target

    5678909764.scr

  • Size

    723KB

  • MD5

    df30947662e982996810396f8998687c

  • SHA1

    ab1cca67c1d71f95e516a21995d2965761bc6829

  • SHA256

    9bcc5591013f066f47701388e95202aa53483c1b73321eecedafd30de2eb381e

  • SHA512

    41e148f5bd8fe19754f6c676323a1b022c0e79d3be5c5de8b3fc030e2dedb46877e5ff792da2965fc8cfc701724ea914a61a80d43590e77421820d22bb484b9a

  • SSDEEP

    12288:ZFw5wFD3n6UwXUTCBvvFfg6DUT0/PSnyUt9H+nruF39h9sAFJEyvQXDkR:ZF4K9wXKIvFfZRGyI9enr6H93bnQXW

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2