Extracted

Extracted

• • Target

    6841176c0e46732c3886f7908a5adf77a6d6ce1327268a9fcb7f2c0262132e41.exe

  • Size

    825KB

  • MD5

    618c0b740f1582b5dde2be66375ceedb

  • SHA1

    afb9a6a58c652265bbd68a26f7130c9e79dc2144

  • SHA256

    6841176c0e46732c3886f7908a5adf77a6d6ce1327268a9fcb7f2c0262132e41

  • SHA512

    df0d49baa4d83add57edaed8a063e380378029e7e9b5ae8b8506571da98ab8ed85f0021c5fcb32fd1f944fd598e1c85fbbd8b5e3216b3edec545144b543679a6

  • SSDEEP

    12288:LTvIyOad8tBn1jfWXiJ9qvx6m/Bex8UOf6Giu+9DDRv:PvIfad8tZ1jfWSJIv4mJeLOp+5F

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2