Extracted

Extracted

• • Target

    scan_88845i.scr.exe

  • Size

    706KB

  • MD5

    72f1e1ddfa5d30ab6d6bec9a51c07184

  • SHA1

    3d500f66cddd83375d9491802197ebcfb3c295b6

  • SHA256

    930f11744b7893c4f7fd88b2838cfe11a63bac6e1c4f4569041ccaa8b9f44285

  • SHA512

    0865cc5308fcae5afa3cdcf9b6eca1a8fea9c29c4e6337589d3363beee05f382a00193d168aaf001c3f95a43a8dfc637f06997375370c188cf94a7ee7617846b

  • SSDEEP

    12288:qnCe1AmEQmgL9CDE0NyDOSGbJf0wI78JotGc4FFrgdpHZOJUZEkvInz2s0JZ96kR:S1bEeCDE0NImJfjG8+tGlBgdZZOXSvJR

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2