Extracted

• • Target

    FIRST PURCHASE ORDER.exe

  • Size

    1.3MB

  • MD5

    e07c6e6de63bdd8421c369c9a39037fb

  • SHA1

    480ea048101330927ce18c105c70a0dc4505a7fb

  • SHA256

    3638d193b36a335bb93dc5f978fb5dc35c23a73d0e6c62a4316181286dc3cb57

  • SHA512

    e82fda2359558e731db3fe83c8e6b2ec51f197efda9f8bd393e2978f414091faea4af92393463e4dada4c5c8fba3e77dbe47599a3b56548870c642b86b98ba73

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2