Extracted

• • Target

    TT COPY.exe

  • Size

    562KB

  • MD5

    151d8349aa1f8d3697c55b1707ca2789

  • SHA1

    ed745b72c682d4b74dec09af7bce32d7acebab4c

  • SHA256

    ea43d517a6f297bacd8199f6df1f0cfaa00acac3c3c2eb125093df80c73a87a6

  • SHA512

    5930a050134b953121b024d169f71d167e675792ec55b837c5f11e33665875f09240ce7281c1171ef20f7d51c88c34bc4ad92d4b86afb8f2827f10439189b4ae

  • SSDEEP

    12288:pJgABfUndS7pkVPaPl00WSETzOKNh3pvckiU3Z7iPuW:pJguUdimyPTEnXfFl

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2