Extracted

• • Target

    948c35522178c3c40726d13d55ad649ccfb2c242cb8cfc4524786e2bd4b13ba5

  • Size

    914KB

  • MD5

    e5493acc5eb33b66942332bde881e7c6

  • SHA1

    8755f98c914fce6ba519504067f175779f2f96e4

  • SHA256

    948c35522178c3c40726d13d55ad649ccfb2c242cb8cfc4524786e2bd4b13ba5

  • SHA512

    04cca7b4668f478300da6798b1d9ecef3e7183d1f90a4c982b0f9411971b2ab1f098d17c7828445ee992b0d1da14a2e77b1d6298d5c92e607c1fb8e8dcff6621

  • SSDEEP

    24576:Jxb85Nc/jpuapFmf7wfMVbX/D76zax1q9:A5EpuHTy6Uai9

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2