Extracted

• • Target

    Attached Please Find our SoA & Invoice Copies.exe

  • Size

    924KB

  • MD5

    9e9bcc015db62a4d467a7e48e28cebf1

  • SHA1

    52572f18618364d8b6e9c91ab5adec169c94f8a0

  • SHA256

    a067ee213cb0219bbe5bc57d21a1b360628b13ce4742a4e9089feb52d1bbee11

  • SHA512

    5a0a68fe1921ac6b6253a2ebcf37ce4e466ceeee32f84d6411b2150d0d670be83daa6eb4a26d60cfb677a1447efdb6a50f8fd7bac5f60b0884a904142a12ad31

  • SSDEEP

    12288:MXGAgHtDg5xE1tEtmJ4/yZoWVXcFEnxolSlTnSO06p5O/gMdVorLb355w3z5LErn:Me4PAJwUoWVXc4WSNnSboGorX3g39Y

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2