Extracted

Extracted

• • Target

    e66b2e8c9622825ba902b9d3465e352884f4c6a61f301dbfb441fddfafb2cfb3

  • Size

    739KB

  • MD5

    ba75b952169181779b219a8ba06cf033

  • SHA1

    d432b335c415b75cb53d249682219dd7ab2b3e04

  • SHA256

    e66b2e8c9622825ba902b9d3465e352884f4c6a61f301dbfb441fddfafb2cfb3

  • SHA512

    cd5f05d8fd40f94095d0430ed7ea279f1d80dd063336accdc3c696d59baa16a32400de299c505869d62146ebc922e32cbac413ef6e5bd73eebddb542569b3fc4

  • SSDEEP

    12288:qrO0+Ri3AgFd473VgtXf4Bs5iAYN/24pd3bxtDjdWOTg7a+JTW4aYJVW66:PQ3Ag47lgB4Bs5sN/24nfDZqm8W49W6

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2