Extracted

• • Target
    SecuriteInfo.com.Win32.MalwareX-gen.52173122.exe
  • Size 1020KB
  • SHA256 0b7cfa65175ad00505483214dc06f8629e795a6823646e7e9024921b731b7767
  • MD5 64f30aaffeca82c0caa77e87b1bfc30b
  • SHA1 d87bbf50b657e4a15efdd300ed39048671a3d96f
  • SHA512 86125efe4ab18377c60d9fd63eafa3cd17c536ddf3512467d2e1cc4fb4fdc18e8d5bedcea6bfba5979aecd0f8995cc5313796bfb88741ccf22f955883b76f164
  • SSDEEP 24576:BjcC6njoJREBN4UDwXj54GAVwob3DjqK+0Ofbl:JcCJjrXj5dAqob3/qK+0G
  • TLSH
    T15A25EF4C2298B10BD8557EB619B1E33906352C9A49E2DD0A5EF57B9F3873BF30C1261E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2