Extracted

• • Target

    e16ed69e1d337d88539ff98cda8d36aabc495db375d68e4f9b86a1843ad8c679.exe

  • Size

    779KB

  • MD5

    8f07580bc25a796a5f0b9100d349d0c2

  • SHA1

    c7c39ff2db999f09d1aaca3bc0f29039d97de49b

  • SHA256

    e16ed69e1d337d88539ff98cda8d36aabc495db375d68e4f9b86a1843ad8c679

  • SHA512

    e0fd2a6273da3aecd7a864a6a33814b9ac8be1721c335ffb3a60c2f0641049573cab3674ee5ec03afaf83ce8997dd2c2cfbb583e6f71fc6357f6cc04ef811ad8

  • SSDEEP

    12288:y5u6WhRSUunBczihl0qeCMzWX6xGoisoXH0stjWwOJ3jB/zs+Pnki3MQQdtGOqw:r6NnBCal2C/XWhzMVGx4+/b3NO

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2