Extracted

Extracted

• • Target

    c314d3fb3da26b9d6571bbefeba0fd0dd4aac29e26a4643932ea034e46fcf650

  • Size

    711KB

  • MD5

    b128f4fb83851afd96c7580f1fd69480

  • SHA1

    8e9115fb23a45c48ceb19f7b2894ddcb488535fd

  • SHA256

    c314d3fb3da26b9d6571bbefeba0fd0dd4aac29e26a4643932ea034e46fcf650

  • SHA512

    a6f155af1e48c9bd3c0e4c4debdac6c3b5ec528d7aab5a062daafc723d4904f80fa723e8df18b55269b7aca886d0b1f88c1d82d0d499cca287c6da813072feda

  • SSDEEP

    12288:qF0VK4A9baHl/P6NdN20v/LzwRqRg8joKviPtqPZPP7sr:g0VKa56xHgYR/EYiPWPPg

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2