Extracted

• • Target

    9e9974fe3a20d29af7b844255b32c7b1fea7f0c7c0fae8b1b7fc3330e86f5b52

  • Size

    755KB

  • MD5

    666925a5d370b82d8b3d930e81f80f27

  • SHA1

    9a31ed86c0d51c9287b96770c0c320f6d198a926

  • SHA256

    9e9974fe3a20d29af7b844255b32c7b1fea7f0c7c0fae8b1b7fc3330e86f5b52

  • SHA512

    1af6ee18bbbf4930e90fa5a50ee300729833f9bbdf4bb385b4e6b08a6b91d3faf9a1e2d59466a08b4b6db4771dbb7e698981886a7707c7c7d2a7fe2361ad902b

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojanmetastealer

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2