Extracted

• • Target

    New order.exe

  • Size

    786KB

  • MD5

    08d7fbb6862dcb82dc8cde80068db6c3

  • SHA1

    86d0b5b41b9061d27e09571e5569e1eb62552367

  • SHA256

    d560c0f26753eba85047f309ddc73797dc7b3c7e14d9b0328eaead50ef7c1338

  • SHA512

    06e1e9b676af40fdc7eec3aafd6a7b057b44616c0117e09a05d9351fd3811ac0c440fc9c5b5b03d8d52fe882af47253137d3c5d7e02ddca067ca1f316f040a32

  • SSDEEP

    24576:72T8S0ck7WVwEddb0euZ5P13lbTYDRWzHrXN9q:7E8S0cd62nu71lbc4zbLq

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2