Extracted

• • Target

    DATASHEET.exe

  • Size

    683KB

  • MD5

    c75e23e42ef5a5df0c9e6a3dac5b6288

  • SHA1

    7893b4c8af41995dd0ec3b29ef64c1ceb9df1d6d

  • SHA256

    d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c

  • SHA512

    cf3ba709924ccfca0c936b28020e44250a82d0c6965960358399826d0f473ba2c5bed027cb5e5ee81b311fd47ae09373089b63056b98de3a533d663f053fd399

  • SSDEEP

    12288:0IipgFGd/w3uEjlcsl5WcP6oEfsB206JSE6Mfo+zli:0IPy1ZsqcO8TDMfB

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2