Extracted

• • Target

    5ce3cf3c2bf91102003e1b59ff37bfdd689ab4655c8af0fb2f5788ef02b8d2a0

  • Size

    1.6MB

  • MD5

    6d8262313406435f0ede1b33e7b961d2

  • SHA1

    af209f70dfb64e6f96d7f42c04a500c768186729

  • SHA256

    5ce3cf3c2bf91102003e1b59ff37bfdd689ab4655c8af0fb2f5788ef02b8d2a0

  • SHA512

    6f259ef4f6bd522ef68e2eecc09f7e2052d15d44a74820b04bbfa69197d2b9ec3c91b2bcfc22e8f0d3a42961cda45fda1d251c8a40fc11c7559a542b800be50b

  • SSDEEP

    24576:jiFjqdWpFxqo/7mF6A2Yn3q6v1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:jiFjqmqo/KF6ONjLoyEkmZ9Y14

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2