Extracted

• • Target
    c21f6749bca94dcdb0c7c83b759e5f5a93861dff4f6d76ebace099d91a69579f.exe
  • Size 1.3MB
  • SHA256 c21f6749bca94dcdb0c7c83b759e5f5a93861dff4f6d76ebace099d91a69579f
  • MD5 571e155ebb3b4f5ef2764f262e3569fe
  • SHA1 d5629e1a72116fd527d13eefc055d9a3b5765af6
  • SHA512 ea24541ce4251a71558a9d1fea01cbcf347cc6781210efe1bd5b37a1f74852b91451c4427039ffd188bc2e710580327ff4125c1f180387204c86f6e22d47949b
  • SSDEEP 24576:qMI1p50LpK6z/KWG+Y0quNUkKOM2vWzA3Fk+cBS/UFRHKkPfXB3m:qM0pks9W7Y0PRX0A32+cB0UHHJXdm
  • TLSH
    T11155F141A2168841E8E187B2A8B2CA7522673DAFB9F1C18E5FDD7F773B733C14494642
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2