Extracted

• • Target

    84606acc239f65763ce8240a0ec64287fdb6d153dbf89d01fcff63ba77586d18

  • Size

    686KB

  • MD5

    d19f55865ee42ec0fa3ab6c877045c71

  • SHA1

    e25651844182ffc6efaf131b539db57dfaf66acf

  • SHA256

    84606acc239f65763ce8240a0ec64287fdb6d153dbf89d01fcff63ba77586d18

  • SHA512

    e5298352f3df55ba42313733fb7a91033d9eb4f599a2e3d509289f1fda1f2948fee93e9257740c1d045068201e14e1b39539951af9d7415914f035e7e1f8973e

  • SSDEEP

    12288:TyqIXBP6wXR62mLtzLIpks6GK7mFnBXpQE9fVL6J05zg4F:uVXBPHh/Etg+lb7m1BZxV

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2