Extracted

• • Target

    15d2a43a0424b074f4e9f306f95bd04f9a3c33561b021364a8edaa78767c631c

  • Size

    658KB

  • MD5

    288ca7008a4c4c5209c6ec3e140686bc

  • SHA1

    70ce1b94aa00f963cf520b436c2d5559b7d44107

  • SHA256

    15d2a43a0424b074f4e9f306f95bd04f9a3c33561b021364a8edaa78767c631c

  • SHA512

    a7ce1d18fa745e0c1c55af0e3cdbb7c9b32ffb1eecb9f1075978c283e8b34edf83607711de93abed5293bb9e6143862a6980ce8d3dd72bcf084dfb9647a0fece

  • SSDEEP

    12288:fH2iNlw0QKtgmz6wAAGCtp46wxdpXSiYFvaytWF7Mvs6gcGBWYTzqbC:v1Xhfz6aG8oMi7F7QuWY6G

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2