Extracted

Extracted

• • Target

    723f6417f6ce1dd3479eb312f48ac91080dfaafdb53a99502b650c2045272796N

  • Size

    1.2MB

  • MD5

    353888b84fcd4ef1adf990fb7e93bee0

  • SHA1

    23fc93a370b6ce040f59f7a7d034795b9abf7d2c

  • SHA256

    723f6417f6ce1dd3479eb312f48ac91080dfaafdb53a99502b650c2045272796

  • SHA512

    1de90ed0b7a364122e96b7b7a16003cdd10fb17869a9f6d058f62f95d2ece519697a117df19c4776ed2f622e8be89e4eca69febdf59fe8e99213b87f9ebac54b

  • SSDEEP

    24576:d1dfZSK0FioeVcQkCwmomRUHAl0fl3Pxqh53AlvO4x:dryioeeQk0lUgmVx

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1