Extracted

• • Target

    48b7b70757bfe6f9ec7d724525f818d70c6b1061c4a09f4793d0643dcef3de3f

  • Size

    764KB

  • MD5

    4c8a2dd95fcd11cbb26d209c4618c8bb

  • SHA1

    9143b0bf388871256368598e95b222e5a384b62d

  • SHA256

    48b7b70757bfe6f9ec7d724525f818d70c6b1061c4a09f4793d0643dcef3de3f

  • SHA512

    c691c5be31ac5784c10fe2b1a6292941037930dae96579e7d1f9aa66642ddbd16028d7f6811bde03eb76bbaa2aae67c5a4f03a29ac514edeec1f785b1d67f585

  • SSDEEP

    12288:omxwwPw0CBaRKNKuU3HzLtEu+B49LF86BQCfmRE1/Am2ox8zdAaoEX5pq9:z5ZYi3TLtEugy86W1REBA1oxMdAaB

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2