Extracted

Extracted

• • Target
    6@[email protected]
  • Size 561KB
  • SHA256 7e375410fe0c29604d0828dd7712aa9e4e48561fd07bc30d6fc86373a3f439ea
  • MD5 f3918b8a992eeef23bba3b4e8d3cd7ea
  • SHA1 04e91a4fda2011e42a90405c6fc336c550028074
  • SHA512 26d6037fb2a59b16adf48d053cb3ad4761879474dfb8a2fa7a460172205524d6882dd6f41e9b1933efac769a5dc526276a4d4b58764d98da15f5550f5921284d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2