Extracted

• • Target

    b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07

  • Size

    891KB

  • MD5

    279794744b9f022ebe655c791a8e1578

  • SHA1

    e45225509f5cafa7add2b6702840fc356a422ba0

  • SHA256

    b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07

  • SHA512

    ad5091feee766f15a49de75dad3c74dced10b8c7e3d574e16a04f815939feb20e058fe4e8ee51733f172d75d83939d0499999d3a69ddb430dc4abbf26b702e4b

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanmetastealer

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2