Extracted

• • Target
    ORDER-KKP-Signature Aluminium-1205-2022PK.exe
  • Size 556KB
  • SHA256 fd3ee92d2d58129a26dd3f43816178047afc35b7b423da06a6db32ea23ff6613
  • MD5 8a48ef963f4df0b06cb372f21d47c1b5
  • SHA1 f0aa0c1ccbba82cb21288157cac7134addb02bef
  • SHA512 bf186acaf13049022975c044373321c141083de7ba87ac02a7dc422159b1b7fac7c162ccfcb1961c9d48c72e5aa5243d14f3f7b8b80d5ef6586e6815f8e0c840
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2