Extracted

• • Target

    PURCHASE ORDER # 12076038 & 12076020.exe

  • Size

    811KB

  • MD5

    c6de6c6bf618e381621a009e0677c80c

  • SHA1

    3d5a0adf745b6b93e3eb631eea3dd8c4f604acf8

  • SHA256

    b27f7a44bbe68d1ceb1d8d2b0a81fe4dcb9dc8047080e6a79aaca37b409cf240

  • SHA512

    f4c396637d3ca0675f53ab53698d2681be6783b88a40aea26eaa2fc134bb9101349075cb0e1c4e40614da11d4528c731f4906b9b1b8f34b47682b53924a7ada4

  • SSDEEP

    12288:6+XrA9MHA4jxpC6OTDCosnLcc+zfvSFXicHsWaT/T05AtGyiFr5cE8LHWc:KuLCbvx6YfvKsWL5U1NvL

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2