Extracted

• • Target
    c9d6f579a7119902f1e05c85fbc93a3dcd0de9ddcdf7ff8eb1d4fa06983b42e4.exe
  • Size 1003KB
  • SHA256 c9d6f579a7119902f1e05c85fbc93a3dcd0de9ddcdf7ff8eb1d4fa06983b42e4
  • MD5 e0dd4fed1c899ad248be4bcc82b5bee5
  • SHA1 95cceecc87c45cad74eaac68fc5b5137cc480398
  • SHA512 2c39ce68e19eb3e158cf0f9945048c4e9eed89bf05577e4545eaf35b9427082054684a98411fd38b20029f3b18251537961bdd6fc09325068b94a7790b69ee42
  • SSDEEP 24576:upu6bUOrs2bf7BoeFMBG9GEZyx9/X788fAAcVLPDIm:EUOrs2bfaeFMBQfwx93fAhPl
  • TLSH
    T15D25129532D5CB31C4654FF4C97606648FB63F4A5AF0E24BEEB9FCCAAA75B400920613
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2