Extracted

• • Target

    information.exe

  • Size

    1.1MB

  • MD5

    b3f2deb005bc80453da9d819482b11ca

  • SHA1

    f6c2437095ed367c805a40d7018e4ee26b85b91a

  • SHA256

    acc9bb38581081506db62caf5850f4b8819296a1be01202b47c44d3950e7ebb2

  • SHA512

    f8a3aecf4e25854817c4a230743e29a55a7f8cc2fb8468de2c20ec8e8f344cc996d1ffaa51b1968c7a8f9ffff21687285fd931e6184f05b34040580a53ec7612

  • SSDEEP

    24576:yDIm+CwxbNuTrG2muk2P6BRQfpmYeWPd+:yDIpCwx5+GGyfUpbPQ

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2