Extracted

• • Target

    d387bc9dc482dc2c34301df9a24716472d122ff2e1212b2f66681b55b8d67bd1

  • Size

    731KB

  • MD5

    cf034ec3c5f2b411ff61a520e9d09798

  • SHA1

    464f12ca64390d9cd62e28905422397b224f5482

  • SHA256

    d387bc9dc482dc2c34301df9a24716472d122ff2e1212b2f66681b55b8d67bd1

  • SHA512

    715ddd012ff6daf481e29b908b73e203daa565afdb6f2839776759398a6e099252284ffd3d9579e67eba2cefbe909438b0581bc9e2ea0fd9370072fe75e6beee

  • SSDEEP

    12288:3BmETHw3JsYqxLXaS7bCcaq+FDfjVIW0iqIldTQvr9:cE0ybXbf+FfjiDIlGz

  Score

  10^/10

  agentteslacollectiondiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2