Extracted

• • Target

    0b4fc883a3ab24b0c65a8d19dedafeac5b1c1ca357f4154317ada9517c593b84

  • Size

    560KB

  • MD5

    f4f01da885c52a682060607332aaa4a0

  • SHA1

    134f77704bc306a95941309d63e5b6e66dd48c13

  • SHA256

    0b4fc883a3ab24b0c65a8d19dedafeac5b1c1ca357f4154317ada9517c593b84

  • SHA512

    7515446df9828f93579be38d095f5117c8b470cac0449f1fd848eef82b15a1db318b6d685647f627bc2c50bf59b845062f325287c91a125a691f9445e186c43a

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojanmetastealer

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2