Extracted

• • Target

    42c52ed2af4708289cb182a0fd83026691eabc7c4916a3ef0cf8a01b5f890856.exe

  • Size

    733KB

  • MD5

    eedbda81d4f3d69ee2798e40a8a5572b

  • SHA1

    68226fb98f6e93db77d607dcc305716e8a80871d

  • SHA256

    42c52ed2af4708289cb182a0fd83026691eabc7c4916a3ef0cf8a01b5f890856

  • SHA512

    e83bdf38d169461846fd63f34b5458f3198adbe796f8be9d7947219a4e9b67cb51e97a39065a1ba49131f9a310de7332eab0d5a215053ffde535d30eddcdebb0

  • SSDEEP

    12288:O7G3eV0l1vF6gv+W5DzalTl3YeirTX/8pi+eAH5vgQVT/fRO8UYeA6h:2V0eM1DzalFYvPX/yi+pZvgiLf4Fa6h

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2