Extracted

• • Target

    Remittance slip 060223.exe

  • Size

    858KB

  • MD5

    f572724244ebcdf8911c11e5b4a6ff29

  • SHA1

    91ab9b959e3535e05e06d381646de113880947eb

  • SHA256

    b8dbf3db5d56d847b13c3e517dd9e9e396038948ea1189e7f57c419f493c368c

  • SHA512

    74fc1406fb2d5df6d07fcd02808b32afbd1d951406b5b39a5865c37d07b5262723f99173587961dfcb21835073a057d251a6f45a9f4c93f6b1d1bdcd16d248b3

  • SSDEEP

    12288:0zSggsinDj1dM1o2kSYQHJbaCR+tTshb0kRSdA56SFceC+MCkQ3lo1XS+KhzbuT:0zsuiSYQ2shgk8dQ6wqC9qqI

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2